Vulnerability Intelligence Report
Arbitrary Code Execution with higher privileged users in Multiple WSO2 Products via Script Mediator Engines (GraalJS and NashornJS)
CVE-2025-11093
An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines. Authenticated users with elevated privileges can execute arbitrary code within the integration runtime environment. By default, access to these scripting engines is limited to administrators in WSO2 Micro Integrator and WSO2 Enterprise Integrator, while in WSO2 API Manager, access extends to both administrators and API creators. This may allow trusted-but-privileged users to perform unauthorized actions or compromise the execution environment.
No Active Exploit Signals
CVSS Base Score
8.4
HIGH
Exploitability:1.7
Impact Score:6.1
EPSS Probability:0.40%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-94 ↗CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| WSO2 | WSO2 Micro Integrator | 0 < 4.0.0 (unknown), 4.0.0 < 4.0.0.145 (affected), 4.1.0 < 4.1.0.147 (affected), 4.2.0 < 4.2.0.141 (affected), 4.3.0 < 4.3.0.42 (affected), 4.4.0 < 4.4.0.27 (affected) |
| WSO2 | WSO2 API Manager | 0 < 3.1.0 (unknown), 3.1.0 < 3.1.0.345 (affected), 3.2.0 < 3.2.0.446 (affected), 3.2.1 < 3.2.1.66 (affected), 4.0.0 < 4.0.0.366 (affected), 4.1.0 < 4.1.0.228 (affected), 4.2.0 < 4.2.0.169 (affected), 4.3.0 < 4.3.0.81 (affected), 4.4.0 < 4.4.0.45 (affected), 4.5.0 < 4.5.0.28 (affected) |
| WSO2 | WSO2 Enterprise Integrator | 0 < 6.6.0 (unknown), 6.6.0 < 6.6.0.224 (affected) |
| WSO2 | WSO2 Universal Gateway | 4.5.0 < 4.5.0.27 (affected) |
| WSO2 | WSO2 API Control Plane | 4.5.0 < 4.5.0.29 (affected) |
| WSO2 | WSO2 Traffic Manager | 4.5.0 < 4.5.0.27 (affected) |
| WSO2 | WSO2 Open Banking IAM | 0 < 2.0.0 (unknown), 2.0.0 < 2.0.0.414 (affected) |
| WSO2 | WSO2 Open Banking AM | 0 < 2.0.0 (unknown), 2.0.0 < 2.0.0.394 (affected) |
| WSO2 | WSO2 Identity Server as Key Manager | 0 < 5.10.0 (unknown), 5.10.0 < 5.10.0.365 (affected) |
| WSO2 | org.apache.synapse:synapse-core | 2.1.7.wso2v227 < 2.1.7.wso2v227_99 (affected), 2.1.7.wso2v271 < 2.1.7.wso2v271_88 (affected), 2.1.7.wso2v143 < 2.1.7.wso2v143_121 (affected), 2.1.7.wso2v319 < 2.1.7.wso2v319_13 (affected), 2.1.7.wso2v183 < 2.1.7.wso2v183_72 (affected), 4.0.0.wso2v119 < 4.0.0.wso2v119_27 (affected), 4.0.0.wso2v20 < 4.0.0.wso2v20_93 (affected), 4.0.0.wso2v215 < 4.0.0.wso2v215_26 (affected), 4.0.0.wso2v218 < 4.0.0.wso2v218_1 (affected), 4.0.0.wso2v105 < 4.0.0.wso2v105_13 (affected), 4.0.0.wso2v131 < 4.0.0.wso2v131_5 (affected), 4.0.0-wso2v254 <= * (unaffected) |
| WSO2 | org.apache.synapse:synapse-extensions | 2.1.7.wso2v227 < 2.1.7.wso2v227_99 (affected), 2.1.7.wso2v271 < 2.1.7.wso2v271_88 (affected), 2.1.7.wso2v143 < 2.1.7.wso2v143_121 (affected), 2.1.7.wso2v319 < 2.1.7.wso2v319_13 (affected), 2.1.7.wso2v183 < 2.1.7.wso2v183_72 (affected), 4.0.0.wso2v119 < 4.0.0.wso2v119_27 (affected), 4.0.0.wso2v20 < 4.0.0.wso2v20_93 (affected), 4.0.0.wso2v215 < 4.0.0.wso2v215_26 (affected), 4.0.0.wso2v218 < 4.0.0.wso2v218_1 (affected), 4.0.0.wso2v105 < 4.0.0.wso2v105_13 (affected), 4.0.0.wso2v131 < 4.0.0.wso2v131_5 (affected), 4.0.0-wso2v254 <= * (unaffected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.395%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | WSO2 LLC · Vendor · USA |
| Reserved | 2025-09-27T07:10:05 |
| Published | 2025-11-05T18:31:17 |
| Last Updated | 2025-11-05T19:39:15 |
Community Chatter & Buzz