CVE-2021-45029

CVE-2021-45029: Apache ShenYu 2.4.1 Groovy Code Injection & SpEL Injection

Vendor Apache Software Foundation

Product Apache ShenYu (incubating)

Weakness CWE-94 · Code injection

Published January 25, 2022

Last update August 4, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1.

Key dates

02Disclosure timeline

January 25, 2022 CVE published

August 4, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-45029 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/94.html AskarLabs — CWE-94 write-up Code Injection

Related vulnerabilities

04Related CVE

CVE-2026-4004 Task Manager <= 3.0.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'task_id' Parameter CVE-2026-15011 Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter CVE-2026-32573 WordPress Nelio AB Testing plugin <= 8.2.7 - Remote Code Execution (RCE) vulnerability CVE-2026-48836 WordPress Easy Invoice plugin <= 2.1.19 - Remote Code Execution (RCE) vulnerability CVE-2026-4257 Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality