CVE-2022-24816: OSGeo GeoServer JAI-EXT Code Injection Vulnerability

CISA Known Exploited Vulnerabilities

Name

OSGeo GeoServer JAI-EXT Code Injection Vulnerability

Vendor

OSGeo

Product

JAI-EXT

Added to the catalog

2024-06-26

Due date for US federal agencies

2024-07-17

Weaknesses

CWE-94

Catalog version

2026.10.30

OSGeo GeoServer JAI-EXT contains a code injection vulnerability that, when programs use jt-jiffle and allow Jiffle script to be provided via network request, could allow remote code execution.

Required action (CISA)

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Ransomware use: CISA does not mark known use of this vulnerability in ransomware campaigns.

Links in CISA's notes

• https://github.com/geosolutions-it/jai-ext/releases/tag/1.1.22,
• https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx
• https://nvd.nist.gov/vuln/detail/CVE-2022-24816

Read on 2026-11-02T23:39:54.475Z under licence cisa-kev-cc0@b0067899 from https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

NVD analysis

Status

Analyzed

Published

2022-04-13T21:15:07.683

Last modified

2026-06-17T04:32:35.060

Weaknesses

CWE-94

JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.

References

• https://github.com/geosolutions-it/jai-ext/commit/cb1d6565d38954676b0a366da4f965fef38da1cb (Patch)
• https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx (Vendor Advisory)
• https://github.com/geosolutions-it/jai-ext/commit/cb1d6565d38954676b0a366da4f965fef38da1cb (Patch)
• https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx (Vendor Advisory)
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24816 (US Government Resource)

This product uses the NVD API but is not endorsed or certified by the NVD.

Read on 2026-11-02T23:41:59.479Z under licence nvd-api-terms-of-use@ff2a5288 from https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2022-24816

CVE record

Title (CNA)

Improper Control of Generation of Code in jai-ext

Assigner

GitHub_M

State

PUBLISHED

Published

2022-04-13T20:45:17.000Z

Updated

2025-10-21T23:15:42.188Z

Problem types

CWE-94: Improper Control of Generation of Code ('Code Injection')

JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.

References

• https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx
• https://github.com/geosolutions-it/jai-ext/commit/cb1d6565d38954676b0a366da4f965fef38da1cb

Read on 2026-11-03T01:10:17.792Z under licence cve-terms-of-use@81bfa2f3 from https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2022/24xxx/CVE-2022-24816.json

GitHub Advisory Database

Also known as / affected packages

Defensive techniques (MITRE D3FEND)

D3FEND maps these defensive techniques to the weakness (CWE) that NVD lists for this CVE, through the digital artifacts the weakness affects. D3FEND does not say they stop this vulnerability.

MITRE D3FEND™ knowledge graph. © 2025 The MITRE Corporation.
"The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use D3FEND for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." Terms: https://d3fend.mitre.org/tou/