PatchTheCVE: linkis

CVE-2025-59355: A vulnerability. When org.apache.linkis.metadata.util.HiveUtils.decode() fails to perform Base64 decoding, it

Wed, 17 Jun 2026 09:45:58 +0000

MEDIUM 6.5: A vulnerability. When org.apache.linkis.metadata.util.HiveUtils.decode() fails to perform Base64 decoding, it records the complete input parameter string in the log via logger.error(str + "decode failed", e). If the input parameter contains sensitive information such as Hive Metastore keys, plainte

CVE-2025-29847: A vulnerability in Apache Linkis. Problem Description When using the JDBC engine and da When using the JDBC e

Wed, 17 Jun 2026 09:05:47 +0000

HIGH 7.5: A vulnerability in Apache Linkis. Problem Description When using the JDBC engine and da When using the JDBC engine and data source functionality, if the URL parameter configured on the frontend has undergone multiple rounds of URL encoding, it may bypass the system's checks. This bypass can trigger

CVE-2024-45627: In Apache Linkis <1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicio

Wed, 17 Jun 2026 07:54:35 +0000

MEDIUM 5.9: In Apache Linkis <1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will allow the attacker to read arbitrary files from the Linkis server. Therefore, the parameters in the Mysql JDBC URL should be

CVE-2024-39928: In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn, random string generated

Wed, 17 Jun 2026 07:43:02 +0000

HIGH 7.5: In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn, random string generated by the Token when starting Py4j uses the Commons Lang's RandomStringUtils. Users are recommended to upgrade to version 1.6.0, which fixes this issue.

CVE-2024-27182: In Apache Linkis <= 1.5.0, Arbitrary file deletion in Basic management services on A user with an administr

Wed, 17 Jun 2026 07:19:23 +0000

MEDIUM 4.9: In Apache Linkis <= 1.5.0, Arbitrary file deletion in Basic management services on A user with an administrator account could delete any file accessible by the Linkis system user . Users are recommended to upgrade to version 1.6.0, which fixes this issue.

CVE-2024-27181: In Apache Linkis <= 1.5.0, Privilege Escalation in Basic management services where the attacking user is a

Wed, 17 Jun 2026 07:19:22 +0000

HIGH 8.8: In Apache Linkis <= 1.5.0, Privilege Escalation in Basic management services where the attacking user is a trusted account allows access to Linkis's Token information. Users are advised to upgrade to version 1.6.0, which fixes this issue.

CVE-2023-49566: In Apache Linkis <=1.5.0, due to the lack of effective filtering of parameters, an attacker configuring malic

Wed, 17 Jun 2026 06:36:10 +0000

HIGH 8.8: In Apache Linkis <=1.5.0, due to the lack of effective filtering of parameters, an attacker configuring malicious db2 parameters in the DataSource Manager Module will result in jndi injection. Therefore, the parameters in the DB2 URL should be blacklisted. This attack requires the attacker to

CVE-2023-46801: In Apache Linkis <= 1.5.0, data source management module, when adding Mysql data source, exists remote code e

Wed, 17 Jun 2026 06:31:39 +0000

HIGH 8.8: In Apache Linkis <= 1.5.0, data source management module, when adding Mysql data source, exists remote code execution vulnerability for java version < 1.8.0_241. The deserialization vulnerability exploited through jrmp can inject malicious files into the server and execute them. This attack requi

CVE-2023-41916: In Apache Linkis =1.4.0, due to the lack of effective filtering of parameters, an attacker configuring malici

Wed, 17 Jun 2026 06:23:04 +0000

MEDIUM 6.5: In Apache Linkis =1.4.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will trigger arbitrary file reading. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. This attack requires th