Executive brief
Wolfram Cloud is a multi-tenant platform used for data science and application development. A security flaw in how the platform handles temporary files allows one user to interfere with the startup process of another user's environment on the same shared server. By placing malicious files in a shared temporary directory, an attacker can take control of another user's session, potentially stealing private data or executing unauthorized commands.
Technical details
A race condition exists in Wolfram Cloud version 14.2 during the initialization of the Java Virtual Machine (JVM). The JVM has unrestricted access to the shared /tmp/ directory, including the temporary directories of other users. An attacker with low-privileged access to the same cloud instance can preemptively place malicious .jar files or modify the -init file in these shared locations. Because the JVM resolves these temporary locations early in its classpath, it may load a malicious version of a common library (such as commons-io) instead of the legitimate one. This results in arbitrary code execution in the context of the victim user. The issue is fixed in version 14.2.1.
Affected products
- Wolfram Research Inc. Cloud 14.2.0
Timeline
- 2025-06-20: other: Vendor notified
- 2025-11-11: disclosed: Public disclosure by CERT/CC and researcher
- 2025-11-11: patched: Fixed in version 14.2.1