What is GHSA-64vw-hq5r-5qmj?

GHSA-64vw-hq5r-5qmj is a security advisory published by GitHub Security Advisories with Medium severity. Oinone Pamirs 7.0.0 contains a code execution vulnerability via ScriptRunner. The method...

Which CVE IDs does GHSA-64vw-hq5r-5qmj cover?

GHSA-64vw-hq5r-5qmj covers the following CVE IDs: CVE-2026-39052. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-64vw-hq5r-5qmj?

GHSA-64vw-hq5r-5qmj has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-64vw-hq5r-5qmjMediumCVSS 6.5

Oinone Pamirs 7.0.0 contains a code execution vulnerability via ScriptRunner. The method...

Vendor

GitHub Security Advisories

Published

May 15, 2026

Last Modified

May 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-39052 →

📋 Description

Oinone Pamirs 7.0.0 contains a code execution vulnerability via ScriptRunner. The method ScriptRunner.run(String expression, String type, Map<String, Object> context) evaluates attacker-controlled script expressions through the underlying script engine without sandboxing or allowlist restrictions.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-39052
https://gist.github.com/Misakim1/859c3eb9ced699089ee0747dae9bedc1
https://github.com/oinone/oinone-pamirs
https://www.oinone.top/changelog
https://github.com/advisories/GHSA-64vw-hq5r-5qmj