Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2022-36944 EUVD-2022-6746GHSA-8qv5-68g4-248j

Scala subject to file deletion, code execution due to Java deserialization chain with LazyList object deserialization

Published Sep 23, 2022 · Updated May 27, 2025 · Assigned by mitre

Package: org.scala-lang:scala-library Ecosystem: Maven

Description

Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.scala-lang:scala-library >= 2.13.0, < 2.13.9 2.13.9 GHSA-8qv5-68g4-248j

Advisories 7

References