【高危】openam-scripting：远程代码执行风险（GHSA-69j4-qvqr-hpw3）

安全情报快照 · 风险级别：高危 · CVE-2026-47424 · GHSA-69j4-qvqr-hpw3

先看结论

openam-scripting存在远程代码执行风险，<= 16.0.6 受影响，建议升级至 16.1.1。

影响范围

生态	组件	受影响版本	首个修复版本
maven	`org.openidentityplatform.openam:openam-scripting`	<= 16.0.6	16.1.1

处置建议

优先将 org.openidentityplatform.openam:openam-scripting 升级至 16.1.1 或更高版本；升级前请结合业务依赖完成兼容性验证。

上游技术详情（原文）

Summary

Description

A Protection Mechanism Failure (CWE-693) in OpenAM's server-side scripting sandbox allows an authenticated script author execute operating-system commands from the OpenAM JVM with the default class allow and deny lists. This impacts OpenAM Community Edition through version 16.0.6. This issue was patched in version 16.1.1.

Impact

An authenticated user (for example, a realm admin) who can create or edit server-side scripts for an executed context can run OS commands as the OpenAM application server admin. For a sub-realm RealmAdmin, this crosses the documented boundary from realm-scoped administration to JVM/host execution, effectively compromising the whole OpenAM process and every realm it serves. The sandbox is the only code-level defense between a realm script author and arbitrary JVM/OS execution.

Patch

This has been patched in OpenAM Community Edition version 16.1.1. Users are encouraged to update to the latest release.

来源与许可

本页自动同步 GitHub Advisory Database 的公开数据，并保留上游原文供核验；不宣称原创分析。数据许可：CC-BY-4.0。