CVE-2025-0982 Sandbox Escape in Google Cloud Application Integration's JavaScript Task (Rhino Engine)
Attackers can execute arbitrary unsandboxed code via crafted JavaScript in Google Cloud Application Integration's Rhino engine, which is now deprecated.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-0982?
CVE-2025-0982 is a critical code injection vulnerability in Google Cloud Application Integration, published on 6 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sandbox escape in the JavaScript Task feature of Google Cloud Application Integration allows an actor to execute arbitrary unsandboxed code via crafted JavaScript code executed by the Rhino engine. Effective January 24, 2025, Application Integration will no longer support Rhino as the JavaScript execution engine. No further fix actions are needed.
Weakness: CWE-829
Which versions are affected by CVE-2025-0982?
It affects 1 product.
Products include Google Application Integration.
How do I fix CVE-2025-0982?
No fix has been published for CVE-2025-0982 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-0982 being exploited?
There is no known exploitation of CVE-2025-0982 in the wild and no public exploit code.
Sources
Also known as GHSA-96rr-gw5q-j9vr.