CVE-2026-75411: JeecgBoot AI Flow RCE Vulnerability

CVE-2026-75411 Overview

CVE-2026-75411 is a remote command execution vulnerability in JeecgBoot v3.9.2, an open-source enterprise low-code development platform. The flaw resides in the CodeNode component of the AI Flow module, which supports Groovy script execution. The SecurityCheck class implements a blacklist to intercept dangerous method calls, but the dynamic nature of Groovy permits attackers to bypass this filter through string concatenation and reflection. Successful exploitation allows arbitrary operating system command execution on the host running JeecgBoot.

Critical Impact
Attackers who can submit Groovy scripts to the AI Flow CodeNode can bypass the sandbox and execute arbitrary commands on the server.

Affected Products

JeecgBoot v3.9.2
JeecgBoot AI Flow module (CodeNode component)
JeecgBoot SecurityCheck blacklist sandbox

Discovery Timeline

2026-08-26 - CVE-2026-75411 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-75411

Vulnerability Analysis

JeecgBoot's AI Flow module exposes a CodeNode component that runs user-supplied Groovy scripts. To restrict dangerous operations, the platform wraps execution with a SecurityCheck class that inspects calls against a blacklist of forbidden classes and methods, such as Runtime, ProcessBuilder, and shell execution APIs. This is a Code Injection vulnerability [CWE-94] combined with an insecure sandbox design [CWE-693]. Blacklist-based sandboxes are difficult to secure in dynamic languages, and Groovy's runtime features provide multiple ways to reach forbidden APIs without naming them literally in source code.

Root Cause

The root cause is reliance on static string matching to block dangerous calls. Groovy supports dynamic method dispatch, GString interpolation, and the Java reflection API. An attacker can construct class and method names at runtime through string concatenation, then resolve them with Class.forName or MethodHandles. Because the sensitive tokens never appear as literals, the SecurityCheck blacklist does not match them. The sandbox therefore fails open when the script uses indirect resolution.

Attack Vector

An authenticated user with access to the AI Flow builder submits a Groovy payload to the CodeNode component. The payload builds strings such as "java.lang." + "Runtime" and looks them up reflectively. The resolved Runtime object then invokes exec on an attacker-controlled command, running under the privileges of the JeecgBoot process. Details are documented in the JeecgBoot GitHub Issue #9691. No verified proof-of-concept code is reproduced here; refer to the upstream issue for technical specifics.

Detection Methods for CVE-2026-75411

Indicators of Compromise

Unexpected child processes spawned by the JeecgBoot Java process, such as sh, bash, cmd.exe, powershell.exe, or curl.
Groovy scripts stored in AI Flow definitions that contain Class.forName, getDeclaredMethod, MethodHandles, or heavy use of string concatenation to build class names.
Outbound network connections from the JeecgBoot host to unknown addresses shortly after AI Flow executions.

Detection Strategies

Inspect submitted Groovy scripts for reflection primitives and dynamic class resolution patterns before execution.
Correlate AI Flow CodeNode execution events with process creation telemetry on the underlying host.
Alert on any process creation whose parent is the JeecgBoot JVM and whose image is a shell, scripting, or network utility.

Monitoring Recommendations

Enable verbose audit logging in the AI Flow module and forward it to a central log platform for retention and search.
Baseline normal outbound connections from the JeecgBoot server and alert on deviations.
Monitor file writes under the JeecgBoot working directory for new executables or scripts dropped after CodeNode runs.

How to Mitigate CVE-2026-75411

Immediate Actions Required

Restrict access to the AI Flow module to trusted administrators only, using role-based access control.
Disable the CodeNode Groovy execution feature in production environments where it is not required.
Place the JeecgBoot service behind network segmentation so that outbound traffic to the internet is denied by default.

Patch Information

At the time of NVD publication on 2026-08-26, no vendor-fixed release is referenced in the CVE record. Track the upstream JeecgBoot GitHub Issue #9691 for remediation status, and upgrade to the first release that removes the blacklist sandbox in favor of an allowlist or a fully isolated execution runtime.

Workarounds

Replace the blacklist-based SecurityCheck with an allowlist that permits only specific Groovy classes and methods required by legitimate flows.
Execute Groovy scripts in an out-of-process sandbox with a Java SecurityManager policy, or in a container with no shell binaries and no network egress.
Strip or reject scripts containing reflection APIs such as Class.forName, getMethod, getDeclaredMethod, and MethodHandles prior to execution.

bash

# Example: block outbound egress from the JeecgBoot host except to required services
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -p tcp -d <db_host> --dport 3306 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -d <allowed_api> -j ACCEPT
iptables -A OUTPUT -j REJECT