CVE-2021-37694: Code injection issue for java-spring-cloud-stream-template

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-08-11 · updated 2026-06-17
Weakness: CWE-94

Description

@asyncapi/java-spring-cloud-stream-template generates a Spring Cloud Stream (SCSt) microservice. In versions prior to 0.7.0 arbitrary code injection was possible when an attacker controls the AsyncAPI document. An example is provided in GHSA-xj6r-2jpm-qvxp. There are no mitigations available and all users are advised to update.

Affected products

asyncapi java-spring-cloud-stream-template: before 0.7.0 — fixed in 0.7.0

How to fix

Upgrade to a fixed version: asyncapi java-spring-cloud-stream-template 0.7.0. Check the vendor advisory for mitigations.

References

https://github.com/asyncapi/java-spring-cloud-stream-template/security/advisories/GHSA-xj6r-2jpm-qvxp
https://github.com/asyncapi/java-spring-cloud-stream-template/security/advisories/GHSA-xj6r-2jpm-qvxp

Get alerted when CVE-2021-37694 or the next vulnerability affects your stack