VYPR
← All advisories
High severity8.8NVD Advisory· Published Jan 29, 2021· Updated Jun 17, 2026

CVE-2021-25646

CVE-2021-25646

Description

Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.druid:druidMaven
< 0.20.10.20.1

Affected products

3

Patches

Vulnerability mechanics

References

31

News mentions

1