CVE-2023-35042 GeoServer RCE due to improper control of generation of code in jai-ext`Jiffle` map algebra language

What is CVE-2023-35042?

CVE-2023-35042 is a critical code injection vulnerability in n/a, published on 12 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a wps:Execute request, as exploited in the wild in June 2023. NOTE: the vendor states that they are unable to reproduce this in any version.

Which versions are affected by CVE-2023-35042?

18 open source packages ship an affected version, including org.geoserver:gs-wfs, org.geoserver:gs-wms and org.geoserver:gs-wps. It affects 1 product.

Products include Geoserver Geoserver.

How do I fix CVE-2023-35042?

Upgrade org.geoserver:gs-wfs to a fixed version for your release line: 2.18.6, 2.19.6 or 2.20.4.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2023-35042 being exploited?

There is no known exploitation of CVE-2023-35042 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2024-36401 OSGeo GeoServer GeoTools Eval Injection Exploited Critical 9.8
• CVE-2025-58360 OSGeo GeoServer Improper Restriction of XML External Entity Reference Exploited High 8.2
• CVE-2024-24749 Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat High 7.5
• CVE-2023-41877 GeoServer log file path traversal vulnerability High 7.2
• CVE-2023-51444 GeoServer arbitrary file upload vulnerability in REST Coverage Store API High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-59x6-g4jr-4hxc.