High

Integrated Scripting vulnerable to arbitrary code execution via Java reflection

Type: advisorySources: OSV

Integrated Scripting is a tool for creating scripts for handling complex operations in Integrated Dynamics. Minecraft users who use Integrated Scripting prior to versions 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, and 1.19.2-1.0.10 may be vulnerable to arbitrary code execution. By using Java reflection on a thrown exception object it's possible to escape the JavaScript sandbox for IntegratedScripting's Variable Cards, and leverage that to construct arbitrary Java classes and invoke arbitrary Java methods. This vulnerability allows for execution of arbitrary Java methods, and by extension arbitrary native code e.g. from `java.lang.Runtime.exec`, on the Minecraft server by any player with the ability to create and use an IntegratedScripting Variable Card. Versions 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, and 1.19.2-1.0.10 fix the issue.

Products: Not specified
Affected versions: Not specified
Fixed versions: Not specified
CVEs: CVE-2025-27107
Confirmed fixed CVEs: Not specified
Updated in this feed: 3 Nov 2026, 07:16 UTC · Revision 1

Source evidence

Integrated Scripting vulnerable to arbitrary code execution via Java reflection

core-osv · Original source

Published 13 Mar 2025, 16:55 UTC

osv:CVE-2025-27107

Complete source record

{
  "id": "386694171622ee580654ffe269852341d1b536464f009d5973f579d053883fcd",
  "url": "https://osv.dev/vulnerability/CVE-2025-27107",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Integrated Scripting vulnerable to arbitrary code execution via Java reflection",
    "summary": "Integrated Scripting is a tool for creating scripts for handling complex operations in Integrated Dynamics. Minecraft users who use Integrated Scripting prior to versions 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, and 1.19.2-1.0.10 may be vulnerable to arbitrary code execution. By using Java reflection on a thrown exception object it's possible to escape the JavaScript sandbox for IntegratedScripting's Variable Cards, and leverage that to construct arbitrary Java classes and invoke arbitrary Java methods. This vulnerability allows for execution of arbitrary Java methods, and by extension arbitrary native code e.g. from `java.lang.Runtime.exec`, on the Minecraft server by any player with the ability to create and use an IntegratedScripting Variable Card. Versions 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, and 1.19.2-1.0.10 fix the issue.",
    "evidence": "osv:CVE-2025-27107",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2025-27107",
      "aliases": [
        "CVE-2025-27107",
        "GHSA-2v5x-4823-hq77"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/cyclopsmc/integratedscripting",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "cc5d6be6b6cd4024a2bf732947ea3655a1f8d0cb"
                },
                {
                  "fixed": "28c1bdd0decd638b117fd1b071aa6407095866e2"
                },
                {
                  "fixed": "ce8e9bb3758d4121db37486e6cf18838aa8bb987"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.21.1-1.0.17"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.20.1-1.0.13"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.19.2-1.0.10"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  }
                ]
              }
            }
          ],
          "versions": [
            "1.21.1-1.0.16",
            "1.19.2-1.0.9",
            "1.21.1-1.0.15",
            "1.20.1-1.0.12",
            "1.20.1-1.0.11",
            "1.21.1-1.0.14",
            "1.20.1-1.0.10",
            "1.21.1-1.0.13",
            "1.21.1-1.0.12",
            "1.20.1-1.0.9",
            "1.21.1-1.0.11",
            "1.20.1-1.0.8",
            "1.19.2-1.0.8",
            "1.21.1-1.0.10",
            "1.21.1-1.0.9",
            "1.20.1-1.0.7",
            "1.19.2-1.0.7",
            "1.21.1-1.0.8",
            "1.20.1-1.0.6",
            "1.19.2-1.0.6",
            "1.20.1-1.0.5",
            "1.19.2-1.0.5",
            "1.21.1-1.0.7",
            "1.21.1-1.0.6",
            "1.20.1-1.0.4",
            "1.19.2-1.0.4",
            "1.21-1.0.5",
            "1.21-1.0.4",
            "1.20.1-1.0.3",
            "1.19.2-1.0.3",
            "1.21-1.0.3",
            "1.20.4-1.0.3",
            "1.20.4-1.0.2",
            "1.20.1-1.0.2",
            "1.19.2-1.0.2",
            "1.20.4-1.0.1",
            "1.19.2-1.0.1",
            "1.20.1-1.0.1",
            "1.20.1-1.0.0",
            "1.19.2-1.0.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27107.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:26.810646375Z",
      "provider": "osv",
      "references": [
        "https://github.com/CyclopsMC/IntegratedScripting/blob/29051aace619604fb5dd60624b72dba428fea2f2/src/main/java/org/cyclops/integratedscripting/evaluate/ScriptHelpers.java#L46",
        "https://github.com/CyclopsMC/IntegratedScripting/blob/29051aace619604fb5dd60624b72dba428fea2f2/src/main/java/org/cyclops/integratedscripting/evaluate/translation/ValueTranslators.java",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27107.json",
        "https://github.com/CyclopsMC/IntegratedScripting/security/advisories/GHSA-2v5x-4823-hq77",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-27107"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-74"
        ],
        "cna_assigner": "GitHub_M",
        "unresolved_ranges": [
          {
            "extracted_events": [
              {
                "range": [
                  {
                    "fixed": "1.21.4-1.0.9-254"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StringRangeExpression"
              }
            ]
          }
        ],
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27107.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-27107",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 493322,
  "published_at": "2025-03-13T16:55:06.914+00:00"
}