CVE-2025-27107: Integrated Scripting RCE Vulnerability

CVE-2025-27107 Overview

CVE-2025-27107 is a sandbox escape vulnerability in Integrated Scripting, a Minecraft mod that lets players create scripts for Integrated Dynamics. The flaw allows any player who can create and use an Integrated Scripting Variable Card to execute arbitrary Java methods on the Minecraft server. Attackers escape the JavaScript sandbox by abusing Java reflection on a thrown exception object, then construct arbitrary Java classes and invoke methods such as java.lang.Runtime.exec. The issue is classified under [CWE-74] (Improper Neutralization of Special Elements in Output). Versions 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, and 1.19.2-1.0.10 contain the fix.

Critical Impact
Any authenticated player with Variable Card privileges can achieve arbitrary native code execution on the Minecraft server, leading to full server compromise.

Affected Products

Integrated Scripting for Minecraft 1.21.1 prior to 1.21.1-1.0.17
Integrated Scripting for Minecraft 1.21.4 prior to 1.21.4-1.0.9-254
Integrated Scripting for Minecraft 1.20.1 prior to 1.20.1-1.0.13 and Minecraft 1.19.2 prior to 1.19.2-1.0.10

Discovery Timeline

2025-03-13 - CVE-2025-27107 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-27107

Vulnerability Analysis

Integrated Scripting embeds a JavaScript engine to evaluate user-supplied logic stored in Variable Cards. The runtime is intended to isolate untrusted script code from the host Java Virtual Machine (JVM). The sandbox boundary fails when a script triggers an exception and then walks the exception object via Java reflection. From that reference, an attacker reaches into the JVM class loader and instantiates arbitrary classes. Once arbitrary class lookup is possible, the script can invoke any public Java method available to the server process. This includes process execution APIs such as java.lang.Runtime.exec, which yields native command execution under the privileges of the Minecraft server.

Root Cause

The root cause is incomplete neutralization of objects crossing the sandbox boundary. The script translation layer in ScriptHelpers and ValueTranslators returns native Java exception instances to script context without stripping reflective metadata. This allows untrusted JavaScript to reach Class, Method, and ClassLoader references through standard reflection.

Attack Vector

The attack requires only in-game privileges to create and use a Variable Card. A player crafts a Variable Card whose script intentionally throws an exception, captures the exception object, and then chains reflective calls to load and invoke arbitrary Java methods. No server console access, operator privileges, or local file system access is required. Exploitation occurs over the standard Minecraft network protocol used by connected clients.

Descriptive technical references are available in the GitHub Security Advisory GHSA-2v5x-4823-hq77, the ScriptHelpers source, and the ValueTranslators source.

Detection Methods for CVE-2025-27107

Indicators of Compromise

Unexpected child processes spawned by the Minecraft server JVM, particularly shells, package managers, or network utilities invoked via Runtime.exec.
Variable Card script content containing references to getClass, getClassLoader, forName, or java.lang.Runtime strings.
Outbound network connections from the Minecraft server process to addresses unrelated to game traffic, including unexpected DNS lookups.
New or modified files in the server working directory immediately after Variable Card usage by a non-operator player.

Detection Strategies

Inspect Integrated Scripting Variable Card payloads stored on disk for reflective access patterns and exception-driven control flow.
Hunt on endpoint telemetry for the Java process hosting the Minecraft server creating non-Java child processes.
Correlate player Variable Card activity in server logs with process and network events generated within the same time window.

Monitoring Recommendations

Enable process creation auditing on the server host and alert when the Java process forks a shell or interpreter.
Forward Minecraft server logs and host telemetry to a central log platform and retain Variable Card execution records.
Establish a baseline of legitimate Variable Card script behavior to surface deviations involving reflection or class loading.

How to Mitigate CVE-2025-27107

Immediate Actions Required

Upgrade Integrated Scripting to 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, or 1.19.2-1.0.10 matching the Minecraft version in use.
Restrict who can place and configure Variable Cards on production servers until the patch is deployed.
Review existing Variable Card scripts on running worlds for reflective payloads before resuming normal access.

Patch Information

The maintainers released fixed builds in versions 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, and 1.19.2-1.0.10. The fix removes the reflective escape path through exception objects returned to the script context. Refer to the GitHub Security Advisory GHSA-2v5x-4823-hq77 for release notes.

Workarounds

Remove the Integrated Scripting mod from the server until upgrade is possible if untrusted players have access.
Limit server access to a trusted allowlist of players while the vulnerable version remains installed.
Run the Minecraft server under a dedicated low-privilege user account and within a container or sandbox to constrain the impact of native command execution.

bash

# Example: run the Minecraft server as a low-privilege user with a restricted working directory
useradd -r -s /usr/sbin/nologin -d /opt/minecraft mcserver
chown -R mcserver:mcserver /opt/minecraft
sudo -u mcserver java -Xmx4G -jar /opt/minecraft/server.jar nogui