How severe is GHSA-j7j9-5253-f7vh?

GHSA-j7j9-5253-f7vh has a CVSS score of 9.1/10, rated CRITICAL. Immediate patching is strongly recommended.

Which packages are affected by GHSA-j7j9-5253-f7vh?

GHSA-j7j9-5253-f7vh affects the following packages: com.ritense.valtimo:document (Maven), com.ritense.valtimo:case (Maven), com.ritense.valtimo:contract (Maven). Ecosystems affected: Maven.

How do I fix GHSA-j7j9-5253-f7vh?

Update com.ritense.valtimo:document to 12.32.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-j7j9-5253-f7vh is resolved across your whole dependency graph.

How do I detect GHSA-j7j9-5253-f7vh in my Maven dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for com.ritense.valtimo:document. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

How do I mitigate GHSA-j7j9-5253-f7vh if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against GHSA-j7j9-5253-f7vh?

O3 pinpoints whether GHSA-j7j9-5253-f7vh is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Is GHSA-j7j9-5253-f7vh actively exploited in the wild?

No public exploit code has been indexed for GHSA-j7j9-5253-f7vh yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-j7j9-5253-f7vh published, and has it been updated?

GHSA-j7j9-5253-f7vh was published on May 6, 2026 and was last updated on May 14, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

☕ Maven

GHSA-j7j9-5253-f7vh

CRITICAL

GHSA-j7j9-5253-f7vh is a critical-severity (CVSS 9.1) remote code execution vulnerability in com.ritense.valtimo:document. O3 Security confirms whether GHSA-j7j9-5253-f7vh is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.

Valtimo has SpEL injection via StandardEvaluationContext that allows Remote Code Execution by admin users

Also known asCVE-2026-42555

Published

May 6, 2026

Updated

May 14, 2026

Affected

3 pkgs

Patched

3 / 3

Exploits

None indexed

Blast Radius

3 pkgs affected

☕com.ritense.valtimo:document☕com.ritense.valtimo:case☕com.ritense.valtimo:contract

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Multiple classes evaluate Spring Expression Language (SpEL) expressions from user-supplied input using StandardEvaluationContext, which provides unrestricted access to Java types and methods. An authenticated user with the ADMIN role can achieve Remote Code Execution and credential exfiltration.

Impact

An attacker with ADMIN credentials can:

Execute arbitrary OS commands via T(java.lang.Runtime).getRuntime().exec('...')
Exfiltrate all environment variables (database passwords, API keys, Keycloak secrets) via T(java.lang.System).getenv()
Read JVM system properties via T(java.lang.System).getProperties()
Load arbitrary classes via T(java.lang.Class).forName('...')

Affected Components

1. DocumentMigrationService (since 12.0.0)

Exploitable through the document migration REST API:

POST /api/management/v1/document-definition/migrate
POST /api/management/v1/document-definition/migration/conflicts

The malicious SpEL expression is supplied in the source or target field of a DocumentMigrationPatch object in the request body, using the ${...} template syntax.

In 12.x: com.ritense.document.service.DocumentMigrationService#handleSpelExpression (document module)
In 13.x: same class, moved to the case module

2. Condition (since 13.4.0)

Exploitable through any admin-configured widget, dashboard, or feature that uses the Condition framework. The SpEL expression is supplied in the value field of a condition's JSON configuration.

com.ritense.valtimo.contract.conditions.Condition#resolveValue (contract module)

This component has a significantly wider attack surface than DocumentMigrationService, as conditions are used across many modules.

Remediation

Replace StandardEvaluationContext with SimpleEvaluationContext in both affected classes, which disallows Java type references and arbitrary method invocation:

val evaluationContext = SimpleEvaluationContext
    .forPropertyAccessors(MapAccessor(), jsonPropertyAccessor)
    .build()

Affected Packages

3 total 3 fixed

Ecosystem	Package	Vulnerable range	Fix
☕Maven	`com.ritense.valtimo:document`	≥ 12.0.0&&< 12.32.0	12.32.0
☕Maven	`com.ritense.valtimo:case`	≥ 13.0.0&&< 13.23.0	13.23.0
☕Maven	`com.ritense.valtimo:contract`	≥ 13.4.0&&< 13.23.0	13.23.0

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for com.ritense.valtimo:document. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update com.ritense.valtimo:document to 12.32.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-j7j9-5253-f7vh is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-j7j9-5253-f7vh is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-j7j9-5253-f7vh. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

### Summary Multiple classes evaluate Spring Expression Language (SpEL) expressions from user-supplied input using `StandardEvaluationContext`, which provides unrestricted access to Java types and methods. An authenticated user with the ADMIN role can achieve Remote Code Execution and credential exfiltration. ### Impact An attacker with ADMIN credentials can: - **Execute arbitrary OS commands** via `T(java.lang.Runtime).getRuntime().exec('...')` - **Exfiltrate all environment variables** (database passwords, API keys, Keycloak secrets) via `T(java.lang.System).getenv()` - **Read JVM system

O3 Security · Impact-Aware SCA

Is GHSA-j7j9-5253-f7vh in your dependencies?

O3 detects GHSA-j7j9-5253-f7vh across Maven dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works