oss-security - CVE-2025-30761：A vulnerability in JDK's Nashorn Allows for Arbitrary Code Execution

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <c91c769394051f886c25f8bf895ec770dce36a73.162b8ce9.08a1.4e4c.b18b.2fc5a955ed5e@feishu.cn>
Date: Wed, 16 Jul 2025 09:30:03 +0800
From: "liyajie" <liyajie@...neuler.sh>
To: "oss-security" <oss-security@...ts.openwall.com>
Subject: CVE-2025-30761：A vulnerability in JDK's Nashorn Allows for Arbitrary Code Execution

Hello,

There is a security vulnerability in Nashorn within the JDK, which can be exploited to access any Java object in a restricted Nashorn execution environment (specifically, it refers to the use of --no-java or ClassFilter),thereby achieving arbitrary code execution.

Details:
- CVE: CVE-2025-30761
- Subsystem: JDK Nashorn
- Impact: Bypassing security restrictions in a restricted Nashorn execution environment, accessing any Java object, and achieving arbitrary code execution
- Affected versions: Oracle Java SE: 8u451, 8u451-perf, 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14
- Fixed in: It is recommended to upgrade to a JDK version that includes the fix patch.

Description:
In JDK8 - JDK14, Nashorn has always been the built-in JavaScript Engine for Java.
It not only allows dynamic parsing of js in Java, but also allows access to Java classes from within js.

```
ScriptEngine engine0 = new ScriptEngineManager().getEngineByName("nashorn");
String cmd = "Java.type('java.lang.Runtime').getRuntime().exec('calc');";
engine0.eval(cmd);
```

This code will execute the calc system command and bring up the calculator.
For enhance security, in Nashorn's documentation, there is a `--no-java` option that prohibits access to Java classes from JavaScript.

```
System.setProperty("nashorn.args", "--no-java");
ScriptEngine engine0 = new ScriptEngineManager().getEngineByName("nashorn");
String cmd = "Java.type('java.lang.Runtime').getRuntime().exec('calc');";
engine0.eval(cmd);
```

This code will throw an exception:"Java" is not defined
The researcher discovered a way to bypass the --no-java security restriction, allowing unrestricted access to Java objects and the execution of arbitrary code. It is worth mentioning that this bypass way also applies to ClassFilter, another security mechanism added to Nashorn by the JDK in JEP202.

Credit:
Tianyi Cheng(chengtianyi@...wei.com)

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-30761
https://www.oracle.com/security-alerts/cpujul2025.html

Best regards,
Yajie Li

Content of type "text/html" skipped

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.