What’s Vulnerable › Vulnerabilities
CVE-2025-3114: Spotfire Code Execution Vulnerability
- Severity: critical (CVSS 9.4 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-04-09 · updated 2026-06-17
- Weakness: CWE-94
Description
Code Execution via Malicious Files: Attackers can create specially crafted files with embedded code that may execute without adequate security validation, potentially leading to system compromise. Sandbox Bypass Vulnerability: A flaw in the TERR security mechanism allows attackers to bypass sandbox restrictions, enabling the execution of untrusted code without appropriate controls.
Affected products
- Spotfire Deployment Kit used in Spotfire Server: from 14 through 0.6; 14.1.0, 14.2.0, 14.3.0, 14.4.0, 14.4.1
- Spotfire Analyst: from 14 through 0.5; 14.1.0, 14.2.0, 14.3.0, 14.4.0, 14.4.1
- Spotfire Desktop: from 14 through 4.1
- Spotfire Enterprise Runtime for R: from 6 through 1.4
- Spotfire Enterprise Runtime for R - Server Edition: from 1 through 17.6; 1.18.0, 1.19.0, 1.20.0, 1.21.0, 1.21.1
- Spotfire Statistics Services: from 14 through 0.6; 14.1.0, 14.2.0, 14.3.0, 14.4.0, 14.4.1
References
Get alerted when CVE-2025-3114 or the next vulnerability affects your stack