Is CVE-2025-11919 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-11919 being exploited in the wild.

How severe is CVE-2025-11919?

Informational severity, with a CVSS score of 7.4, published 26 June 2026.

Which products and versions are affected?

Wolfram Research Inc. Cloud 14.2.0.

Is there a fix for CVE-2025-11919?

A patch was published on 2025-11-11: Fixed in version 14.2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-11919 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2025-11919?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-11919: Wolfram Cloud JVM classpath poisoning via shared temporary directory

CVE-2025-11919 · Severity: info · CVSS 7.4 · Published 2026-06-26

Wolfram Cloud is a multi-tenant platform used for data science and application development. A security flaw in how the platform handles temporary files allows one user to interfere with the startup process of another user's environment on the same shared server. By placing malicious files in a shared temporary directory, an attacker can take control of another user's session, potentially stealing private data or executing unauthorized commands.

Quick answers

Is CVE-2025-11919 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-11919 being exploited in the wild.
How severe is CVE-2025-11919?: Informational severity, with a CVSS score of 7.4, published 26 June 2026.
Which products and versions are affected?: Wolfram Research Inc. Cloud 14.2.0.
Is there a fix for CVE-2025-11919?: A patch was published on 2025-11-11: Fixed in version 14.2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-11919 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2025-11919?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A race condition exists in Wolfram Cloud version 14.2 during the initialization of the Java Virtual Machine (JVM). The JVM has unrestricted access to the shared /tmp/ directory, including the temporary directories of other users. An attacker with low-privileged access to the same cloud instance can preemptively place malicious .jar files or modify the -init file in these shared locations. Because the JVM resolves these temporary locations early in its classpath, it may load a malicious version of a common library (such as commons-io) instead of the legitimate one. This results in arbitrary code execution in the context of the victim user. The issue is fixed in version 14.2.1.

Affected products

Wolfram Research Inc. Cloud 14.2.0

Timeline

2025-06-20: other: Vendor notified
2025-11-11: disclosed: Public disclosure by CERT/CC and researcher
2025-11-11: patched: Fixed in version 14.2.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.