What is GHSA-2gh6-wc3m-g37f?

GHSA-2gh6-wc3m-g37f is a security advisory published by GitHub Security Advisories with Critical severity. hermes-management is vulnerable to RCE due to Apache commons-jxpath

Why does GHSA-2gh6-wc3m-g37f have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-2gh6-wc3m-g37f?

GHSA-2gh6-wc3m-g37f has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-2gh6-wc3m-g37f?

GHSA-2gh6-wc3m-g37f affects 1 product, including: maven/pl.allegro.tech.hermes:hermes-management:\u003e= 0.8.2, \u003c 2.2.9.

GHSA-2gh6-wc3m-g37fCriticalCVSS 9.8Disclosed before NVD

hermes-management is vulnerable to RCE due to Apache commons-jxpath

Vendor

GitHub Security Advisories

Published

September 17, 2024

Last Modified

August 31, 2026

📋 Description

Impact

hermes-management is vulnerable to RCE when it processes user-controlled data due to using Apache commons-jxpath.

Patches

Upgrade Hermes to at least hermes-2.2.9

References

https://hackinglab.cz/en/blog/remote-code-execution-in-jxpath-library-cve-2022-41852/

🎯 Affected products1

maven/pl.allegro.tech.hermes:hermes-management:>= 0.8.2, < 2.2.9

🔗 References (5)

https://github.com/allegro/hermes/security/advisories/GHSA-2gh6-wc3m-g37f
https://github.com/allegro/hermes/commit/72ecc5aa41e37fd614443dd35d9200b66a61afb1
https://hackinglab.cz/en/blog/remote-code-execution-in-jxpath-library-cve-2022-41852
https://github.com/allegro/hermes/commit/92d4ad0cf6868ba784707772b78e129fedff7a31
https://github.com/advisories/GHSA-2gh6-wc3m-g37f