CVE-2007-6382 Robocode Arbitrary Code Execution
Remote attackers can execute arbitrary Java code in Robocode by exploiting the Event Dispatch Thread via a malicious robot.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2007-6382?
CVE-2007-6382 is a medium-severity code injection vulnerability in n/a, published on 15 Dec 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Event Dispatch Thread in Robocode before 1.5.1 allows remote attackers to execute arbitrary Java code by using a robot to invoke the SwingUtilities.invokeLater method.
Which versions are affected by CVE-2007-6382?
2 open source packages ship an affected version, including net.sf.robocode:robocode.core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
net.sf.robocode:robocode.core Maven | All versions | 1.5.1 |
net.sf.robocode:robocode.core Maven | All versions | 1.5.1 |
Products include Robocode Robocode.
How do I fix CVE-2007-6382?
Upgrade net.sf.robocode:robocode.core to 1.5.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2007-6382 being exploited?
There is no known exploitation of CVE-2007-6382 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2025-14306 Directory Traversal in Robocode's CacheCleaner Component
- CVE-2025-14308 Integer Overflow in Robocode's Buffer Write Method
- CVE-2019-10648 Improper Input Validation in net.sf.robocode:robocode.host allows for external service interaction
- CVE-2025-14307 Insecure Temporary File Creation in Robocode's AutoExtract Component
- CVE-2008-2078 Other in n/a
Sources
Also known as GHSA-xh22-fw58-56pp.