Critical · 9.8 CVE-2025-26074 EUVD-2025-19560GHSA-8gqp-hr9g-pg62

Conductor vulnerable to OS command injection through unrestricted access to Java classes

Published Jun 30, 2025 · Updated Jun 30, 2025 · Assigned by mitre

Description

Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes.

Ecosystem	Package	Affected	Fixed	Record
Maven	org.conductoross:conductor-core	< 3.21.13	3.21.13	GHSA-8gqp-hr9g-pg62