Executive brief
JimuReport, a popular data visualization and reporting tool, contains a critical security flaw that allows unauthorized individuals to run malicious code on the server. By sending a specially crafted request to the reporting interface, an attacker could take control of the system, access sensitive data, or disrupt business operations. This issue affects all versions up to and including 2.3.4.
Technical details
A remote code execution (RCE) vulnerability exists in JimuReport versions 2.3.4 and earlier due to an expression injection flaw. The root cause is located in the /jmreport/executeSelectApi endpoint, which accepts user-supplied input and passes it directly to the Aviator expression engine's execute method without sufficient validation or sandboxing. A remote, unauthenticated attacker can exploit this by submitting malicious Aviator expressions via a network request, leading to arbitrary code execution on the underlying host. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code).
Affected products
- JeecgBoot JimuReport <= 2.3.4
Timeline
- 2026-06-17: disclosed
- 2026-06-17: advisory