Vulnerability Description
Integrated Scripting is a tool for creating scripts for handling complex operations in Integrated Dynamics. Minecraft users who use Integrated Scripting prior to versions 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, and 1.19.2-1.0.10 may be vulnerable to arbitrary code execution. By using Java reflection on a thrown exception object it's possible to escape the JavaScript sandbox for IntegratedScripting's Variable Cards, and leverage that to construct arbitrary Java classes and invoke arbitrary Java methods. This vulnerability allows for execution of arbitrary Java methods, and by extension arbitrary native code e.g. from `java.lang.Runtime.exec`, on the Minecraft server by any player with the ability to create and use an IntegratedScripting Variable Card. Versions 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, and 1.19.2-1.0.10 fix the issue.
Related Weaknesses (CWE)
References
- https://github.com/CyclopsMC/IntegratedScripting/blob/29051aace619604fb5dd60624b
- https://github.com/CyclopsMC/IntegratedScripting/blob/29051aace619604fb5dd60624b
- https://github.com/CyclopsMC/IntegratedScripting/security/advisories/GHSA-2v5x-4
FAQ
What is CVE-2025-27107?
CVE-2025-27107 is a documented vulnerability. Integrated Scripting is a tool for creating scripts for handling complex operations in Integrated Dynamics. Minecraft users who use Integrated Scripting prior to versions 1.21.1-1.0.17, 1.21.4-1.0.9-2...
How severe is CVE-2025-27107?
CVSS scoring is not yet available for CVE-2025-27107. Check NVD for updates.
Is there a patch for CVE-2025-27107?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.