Skip to content
OpenAdvisories
High · 8.8 CVE-2024-43115 EUVD-2024-54950GHSA-3vcp-r62v-xpvg

Apache DolphinScheduler: Alert Script Attack

Published Sep 3, 2025 · Updated Nov 4, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache DolphinScheduler Package: org.apache.dolphinscheduler:dolphinscheduler Ecosystem: Maven

Description

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can execute any shell script server by alert script.

This issue affects Apache DolphinScheduler: before 3.2.2.

Users are recommended to upgrade to version 3.3.1, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache DolphinScheduler < 3.2.2 3.2.2

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.dolphinscheduler:dolphinscheduler < 3.2.2 3.2.2 GHSA-3vcp-r62v-xpvg

References