VYPR
← All advisories
Critical severityNVD Advisory· Published May 23, 2022· Updated Aug 3, 2024

Commandline class shell injection vulnerabilities

CVE-2022-29599

Description

In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Apache Maven maven-shared-utils Commandline class fails to escape double-quoted strings, enabling shell injection attacks.

Vulnerability

The Commandline class in Apache Maven maven-shared-utils prior to version 3.3.3 does not properly escape double-quoted strings when constructing shell commands. This allows an attacker to inject arbitrary shell commands. The vulnerability is tracked as MSHARED-297 [1][2][4].

Exploitation

An attacker can exploit this by providing a crafted argument that contains double quotes and shell metacharacters. When the Commandline class builds a command string, it emits double-quoted arguments without escaping internal quotes, allowing the attacker to break out of the quoting and inject additional commands. No special privileges are required beyond the ability to supply input to a Maven build that uses the vulnerable class [1][2].

Impact

Successful exploitation leads to arbitrary shell command execution with the privileges of the Maven process. This can result in full compromise of the build environment, including data exfiltration, installation of malware, or lateral movement [1][4].

Mitigation

The fix is included in maven-shared-utils version 3.3.3, released on 2022-05-23. Users should upgrade to version 3.3.3 or later. The fix unconditionally single-quotes executable and arguments to prevent injection [2][4]. No workaround is available for earlier versions.

References
  1. NVD - CVE-2022-29599
  2. [MSHARED-297] Unconditionally single quote executable and arguments by roxspring · Pull Request #40 · apache/maven-shared-utils
  3. security - CVE-2022-29599: Apache Maven: Commandline class shell injection vulnerabilities

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.maven.shared:maven-shared-utilsMaven
< 3.3.33.3.3

Affected products

52

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.