Executive brief
JeecgBoot is a low-code development platform with an AI Flow module that allows execution of Groovy scripts through a CodeNode component. An authenticated attacker with the airag:flow:add permission can bypass the security blacklist using string concatenation and reflection to execute arbitrary system commands on the server, leading to complete system compromise.
Technical details
The vulnerability is a blacklist bypass in Groovy script execution within the CodeNode component. The SecurityCheck class attempts to block dangerous calls such as Runtime.getRuntime(), Class.forName(), ProcessBuilder, and exec(), but Groovy's dynamic nature allows attackers to evade this through string concatenation (e.g., "Runtime".getRuntime()) and reflection-based method invocation (e.g., getMethod("ex"+"ec")). This enables arbitrary OS command execution. The attack requires authentication with the airag:flow:add permission; admin users have this permission by default. No official patch information is provided in the advisory.
Affected products
- JeecgBoot JeecgBoot v3.9.2
Timeline
- 2026-06-08: disclosed: Issue opened on GitHub
- 2026-08-26: advisory: Published to NVD as CVE-2026-75411