CVE-2022-24816
OSGeo GeoServer JAI-EXT Code Injection Vulnerability
Published Apr 13, 2022 · updated Jun 16, 2026 · geosolutionsgroup jai-ext
JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.
Timeline
Detection, updates, and resolution for this record.
Apr 13, 2022 · Catalog
Detected
JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inje
Jun 26, 2024 · CISA KEV
Known exploited
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Jul 17, 2024 · CISA KEV
Remediation due
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Jun 16, 2026 · Catalog
Updated
JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inje
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date Jul 17, 2024
Affected
- cpe geosolutionsgroup/jai-extversion unspecified
- vendor OSGeo JAI-EXTversion unspecified
Sources
- CISA KEVCVE-2022-24816
OSGeo GeoServer JAI-EXT contains a code injection vulnerability that, when programs use jt-jiffle and allow Jiffle script to be provided via network request, could allow remote code execution.
cisa.gov - CVE.orgCVE-2022-24816
Official CVE identifier
cve.org - FIRST EPSSCVE-2022-24816
30-day exploitation probability 99.9%
first.org - NIST NVDCVE-2022-24816
JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particul
nvd.nist.gov