Executive brief
Karate Mock Server, a tool used to simulate web services for testing, contains a vulnerability that allows remote attackers to execute commands on the host system. By sending specially crafted web requests (containing malicious code in the body, headers, or parameters), an attacker can take full control of the server process. This can lead to the theft of sensitive data, service disruption, or unauthorized access to the internal network.
Technical details
A Remote Code Execution (RCE) vulnerability exists in Karate Mock Server due to a missing trust boundary between HTTP request data and the Karate expression evaluator. When a mock feature file assigns request-derived objects (like 'request', 'requestHeaders', or 'requestParams') to variables, the engine recursively processes these objects for embedded expressions using 'processEmbeddedExpressions()'. An unauthenticated remote attacker can inject Karate expressions such as '#(Java.type(...))' into JSON bodies, headers, or query parameters. Because the runtime supports Java interop, these expressions are evaluated server-side, allowing for arbitrary command execution. The vulnerability is patched in version 2.1.0.
Affected products
- karatelabs karate-core >= 2.0.1, <= 2.0.10
Timeline
- 2026-06-17: disclosed
- 2026-06-18: advisory: GitHub Advisory published
- 2026-06-18: patched: Version 2.1.0 released