CVE-2021-30181 in the critical feed json
Apache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)
published 2021-05-29 5 y ago modified 2026-06-17 4 mo ago also GHSA-qmfc-6www-fjqw , EUVD-2022-1521
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 60.9%
- EPSS 60.9% chance of exploitation in 30 days, percentile 99.1%
- public exploits
- 0
- none known
Summary
Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.
Patch / fix
- maven com.alibaba:dubbo 2.6.9
- maven org.apache.dubbo:dubbo 2.7.10
- Apache Software Foundation Apache Dubbo 2.6.9, 2.7.9
Exploit prediction
60.86% chance of exploitation in the next 30 days, higher than 99.1% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | com.alibaba:dubbo | >=2.5.0, <2.6.9 |
2.6.9 |
| maven | org.apache.dubbo:dubbo | >=2.5.0, <2.7.10 |
2.7.10 |
Affected products
- Apache Software Foundation Apache Dubbo
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
lists.apache.org
/thread.html/re22410dc704a09bc7032ddf15140cf5e7df3e8ece390fc9032ff5587%40%3Cdev.dubbo.apache.org%3E
web, mailing-list, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2021-30181
advisory
Sources
- CVE List CVE-2021-30181
- GitHub Advisory GHSA-qmfc-6www-fjqw
- NVD CVE-2021-30181
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.