Executive brief
CedarJava is a library used to manage fine-grained access control and authorization policies. A vulnerability in how it handles user input allows attackers to inject malicious code into security policies. This could allow an attacker to bypass security restrictions, granting themselves unauthorized access to sensitive data or preventing legitimate security rules from being enforced.
Technical details
A code injection vulnerability (CWE-94) exists in CedarJava's toCedarExpr() method. The method fails to properly escape special characters, specifically double quotes (") and backslashes (\), when converting Cedar Value types into Cedar source code. If an application uses this method to dynamically construct policy text using user-provided input, an attacker can inject arbitrary Cedar expressions. For example, an attacker could append '|| true' to a permit clause to make it unconditional or '&& false' to a forbid clause to disable it. The vulnerability is reachable over the network if the application exposes policy-generation features to users. Patches are available in versions 2.3.6, 3.4.1, and 4.9.0.
Affected products
- cedar-policy cedar-java < 2.3.6, >= 3.1.2 < 3.4.1, >= 4.0.0 < 4.9.0
Timeline
- 2026-06-18: advisory: Original GitHub advisory published
- 2026-07-13: disclosed: NVD publication date