checkstyle-10.21.0.jar: 4 vulnerabilities (highest severity is: 9.8) [master]

<details>
  <summary>📂 Vulnerable Library - <strong>checkstyle-10.21.0.jar</strong></summary>

Checkstyle is a development tool to help programmers write Java code
    that adheres to a coding standard



**Path to dependency file:** /build.gradle

**Path to vulnerable library:** /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/com.puppycrawl.tools/checkstyle/10.21.0/b9c9f0c7a8189b1e49b5f8822fe3438cd72b6ace/checkstyle-10.21.0.jar


</details>


# Findings
| Finding | Severity | 🎯 CVSS | Exploit Maturity | EPSS | Library | Type | Fixed in | Remediation Available | **Reachability** |
| ------------- | ------------- | ---- | --- | ----- | ----- | ----- | --- | --- | --- |
| [ CVE-2025-46295 ](https://www.mend.io/vulnerability-database/CVE-2025-46295) | 🟣 Critical | 9.8 | Not Defined | < 1% | commons-text-1.3.jar | Transitive | N/A | ❌ | |
| [ CVE-2025-67030 ](https://www.mend.io/vulnerability-database/CVE-2025-67030) | 🟣 Critical | 9.8 | N/A | N/A | plexus-utils-3.3.0.jar | Transitive | N/A | ❌ | |
| [ CVE-2025-48734 ](https://www.mend.io/vulnerability-database/CVE-2025-48734) | 🔴 High | 8.8 | Not Defined | < 1% | commons-beanutils-1.9.4.jar | Transitive | N/A | ❌ | |
| [ CVE-2025-48924 ](https://www.mend.io/vulnerability-database/CVE-2025-48924) | 🟠 Medium | 5.3 | Not Defined | < 1% | commons-lang3-3.8.1.jar | Transitive | N/A | ❌ | |


# Details


<details>
  <summary>
 🟣CVE-2025-46295
  </summary>

### Vulnerable Library - **commons-text-1.3.jar**

Apache Commons Text is a library focused on algorithms working on strings.

**Library home page:** [ https://www.apache.org/ ](https://www.apache.org/)

**Path to dependency file:** /build.gradle

**Path to vulnerable library:** /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.apache.commons/commons-text/1.3/9abf61708a66ab5e55f6169a200dbfc584b546d9/commons-text-1.3.jar



**Dependency Hierarchy:**


- checkstyle-10.21.0.jar (Root Library)
    - doxia-core-1.12.0.jar
        - ❌  **commons-text-1.3.jar** (Vulnerable Library)




***

### Vulnerability Details

Apache Commons Text versions prior to 1.10.0 included interpolation features that could be abused when applications passed untrusted input into the text-substitution API. Because some interpolators could trigger actions like executing commands or accessing external resources, an attacker could potentially achieve remote code execution. This vulnerability has been fully addressed in FileMaker Server 22.0.4.

**Publish Date:** Dec 16, 2025 06:07 PM

**URL:** [ CVE-2025-46295 ](https://www.mend.io/vulnerability-database/CVE-2025-46295)

**Threat Assessment**

Exploit Maturity:Not Defined

EPSS:< 1%

**Score:** 9.8


***
### Suggested Fix

**Type:** Upgrade version

**Origin:** https://support.claris.com/s/answerview?anum=000049059&language=en_US

**Release Date:** Dec 16, 2025 06:16 PM

**Fix Resolution :** org.apache.commons:commons-text:1.10.0


</details>

<details>
  <summary>
 🟣CVE-2025-67030
  </summary>

### Vulnerable Library - **plexus-utils-3.3.0.jar**

A collection of various utility classes to ease working with strings, files, command lines, XML and
    more.

**Library home page:** [ http://codehaus-plexus.github.io/ ](http://codehaus-plexus.github.io/)

**Path to dependency file:** /build.gradle

**Path to vulnerable library:** /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.codehaus.plexus/plexus-utils/3.3.0/cf43b5391de623b36fe066a21127baef82c64022/plexus-utils-3.3.0.jar



**Dependency Hierarchy:**


- checkstyle-10.21.0.jar (Root Library)
    - doxia-module-xdoc-1.12.0.jar
        - ❌  **plexus-utils-3.3.0.jar** (Vulnerable Library)




***

### Vulnerability Details

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code

**Publish Date:** Mar 25, 2026 12:00 AM

**URL:** [ CVE-2025-67030 ](https://www.mend.io/vulnerability-database/CVE-2025-67030)

**Threat Assessment**

Exploit Maturity:N/A

EPSS:N/A

**Score:** 9.8


***
### Suggested Fix

**Type:** Upgrade version

**Origin:** 

**Release Date:** 

**Fix Resolution :** 


</details>

<details>
  <summary>
 🔴CVE-2025-48734
  </summary>

### Vulnerable Library - **commons-beanutils-1.9.4.jar**

Apache Commons BeanUtils provides an easy-to-use but flexible wrapper around reflection and introspection.

**Library home page:** [ https://www.apache.org/ ](https://www.apache.org/)

**Path to dependency file:** /build.gradle

**Path to vulnerable library:** /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/commons-beanutils/commons-beanutils/1.9.4/d52b9abcd97f38c81342bb7e7ae1eee9b73cba51/commons-beanutils-1.9.4.jar



**Dependency Hierarchy:**


- checkstyle-10.21.0.jar (Root Library)
    - ❌  **commons-beanutils-1.9.4.jar** (Vulnerable Library)




***

### Vulnerability Details

Improper Access Control vulnerability in Apache Commons.
A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this protection was not enabled by default. PropertyUtilsBean (and consequently BeanUtilsBean) now disallows declared class level property access by default.
Releases 1.11.0 and 2.0.0-M2 address a potential security issue when accessing enum properties in an uncontrolled way. If an application using Commons BeanUtils passes property paths from an external source directly to the getProperty() method of PropertyUtilsBean, an attacker can access the enum’s class loader via the “declaredClass” property available on all Java “enum” objects. Accessing the enum’s “declaredClass” allows remote attackers to access the ClassLoader and execute arbitrary code. The same issue exists with PropertyUtilsBean.getNestedProperty().
Starting in versions 1.11.0 and 2.0.0-M2 a special BeanIntrospector suppresses the “declaredClass” property. Note that this new BeanIntrospector is enabled by default, but you can disable it to regain the old behavior; see section 2.5 of the user's guide and the unit tests.
This issue affects Apache Commons BeanUtils 1.x before 1.11.0, and 2.x before 2.0.0-M2.Users of the artifact commons-beanutils:commons-beanutils
1.x are recommended to upgrade to version 1.11.0, which fixes the issue.
Users of the artifact org.apache.commons:commons-beanutils2
2.x are recommended to upgrade to version 2.0.0-M2, which fixes the issue.

**Publish Date:** May 28, 2025 01:32 PM

**URL:** [ CVE-2025-48734 ](https://www.mend.io/vulnerability-database/CVE-2025-48734)

**Threat Assessment**

Exploit Maturity:Not Defined

EPSS:< 1%

**Score:** 8.8


***
### Suggested Fix

**Type:** Upgrade version

**Origin:** https://github.com/advisories/GHSA-wxr5-93ph-8wr9

**Release Date:** May 28, 2025 01:32 PM

**Fix Resolution :** https://github.com/apache/commons-beanutils.git - commons-beanutils-2.0.0-M2-RC1,https://github.com/apache/commons-beanutils.git - rel/commons-beanutils-2.0.0-M2,https://github.com/apache/commons-beanutils.git - rel/commons-beanutils-1.11.0,org.apache.commons:commons-beanutils2:2.0.0-M2,commons-beanutils:commons-beanutils:1.11.0


</details>

<details>
  <summary>
 🟠CVE-2025-48924
  </summary>

### Vulnerable Library - **commons-lang3-3.8.1.jar**

Apache Commons Lang, a package of Java utility classes for the
  classes that are in java.lang's hierarchy, or are considered to be so
  standard as to justify existence in java.lang.

**Library home page:** [ https://www.apache.org/ ](https://www.apache.org/)

**Path to dependency file:** /build.gradle

**Path to vulnerable library:** /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/org.apache.commons/commons-lang3/3.8.1/6505a72a097d9270f7a9e7bf42c4238283247755/commons-lang3-3.8.1.jar



**Dependency Hierarchy:**


- checkstyle-10.21.0.jar (Root Library)
    - doxia-core-1.12.0.jar
        - commons-text-1.3.jar
            - ❌  **commons-lang3-3.8.1.jar** (Vulnerable Library)




***

### Vulnerability Details

Uncontrolled Recursion vulnerability in Apache Commons Lang.
This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0.
The methods ClassUtils.getClass(...) can throw StackOverflowError on very long inputs. Because an Error is usually not handled by applications and libraries, a
StackOverflowError could cause an application to stop.
Users are recommended to upgrade to version 3.18.0, which fixes the issue.
 Mend Note: The description of this vulnerability differs from MITRE. 

**Publish Date:** Jul 11, 2025 02:56 PM

**URL:** [ CVE-2025-48924 ](https://www.mend.io/vulnerability-database/CVE-2025-48924)

**Threat Assessment**

Exploit Maturity:Not Defined

EPSS:< 1%

**Score:** 5.3


***
### Suggested Fix

**Type:** Upgrade version

**Origin:** https://github.com/apache/commons-lang/commit/b424803abdb2bec818e4fbcb251ce031c22aca53

**Release Date:** Jul 11, 2025 02:56 PM

**Fix Resolution :** https://github.com/apache/commons-lang.git - commons-lang-3.18.0,org.apache.commons:commons-lang3:3.18.0


</details>

[comment]: <> (<MEND_ISSUE_METADATA>{"identifier":"checkstyle-10.21.0.jar","repoName":"drone-yaml-validator","branchName":"master","type":"SCA_DEP","secondaryBranches":[]}</MEND_ISSUE_METADATA>)

Navigation Menu

Uh oh!

checkstyle-10.21.0.jar: 4 vulnerabilities (highest severity is: 9.8) [master] #2

Findings

Details

Vulnerable Library - commons-text-1.3.jar

Vulnerability Details

Suggested Fix

Vulnerable Library - plexus-utils-3.3.0.jar

Vulnerability Details

Suggested Fix

Vulnerable Library - commons-beanutils-1.9.4.jar

Vulnerability Details

Suggested Fix

Vulnerable Library - commons-lang3-3.8.1.jar

Vulnerability Details

Suggested Fix

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Finding	Severity	🎯 CVSS	Exploit Maturity	EPSS	Library	Type	Fixed in	Remediation Available
CVE-2025-46295	🟣 Critical	9.8	Not Defined	< 1%	commons-text-1.3.jar	Transitive	N/A	❌
CVE-2025-67030	🟣 Critical	9.8	N/A	N/A	plexus-utils-3.3.0.jar	Transitive	N/A	❌
CVE-2025-48734	🔴 High	8.8	Not Defined	< 1%	commons-beanutils-1.9.4.jar	Transitive	N/A	❌
CVE-2025-48924	🟠 Medium	5.3	Not Defined	< 1%	commons-lang3-3.8.1.jar	Transitive	N/A	❌

Uh oh!

checkstyle-10.21.0.jar: 4 vulnerabilities (highest severity is: 9.8) [master] #2

Description

Findings

Details

Vulnerable Library - commons-text-1.3.jar

Vulnerability Details

Suggested Fix

Vulnerable Library - plexus-utils-3.3.0.jar

Vulnerability Details

Suggested Fix

Vulnerable Library - commons-beanutils-1.9.4.jar

Vulnerability Details

Suggested Fix

Vulnerable Library - commons-lang3-3.8.1.jar

Vulnerability Details

Suggested Fix

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions