{"cve":"CVE-2026-55773","nvd":{"published":"2026-07-13T20:16:48.580","modified":"2026-10-24T22:10:00.210","status":"Deferred","description":"CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Cedar-expression injection via unescaped toCedarExpr(). The toCedarExpr() method on Cedar Value types does not escape special characters (\" or \\) when converting values to Cedar source code. If an integrator uses toCedarExpr() to build policy text at runtime from user-controlled values, an actor could inject arbitrary Cedar expressions. For example, injecting || true into a permit ... when { ... } clause could make the permit unconditional, or injecting && false into a forbid clause could prevent the forbid from triggering. This issue requires the integrator to use toCedarExpr() to build policy text at runtime from user-controlled input. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8},"cwes":["CWE-94"],"references":["https://github.com/cedar-policy/cedar-java/security/advisories/GHSA-qmch-v2q9-wg4p"],"products":[],"source":"nvd","synced_at":"2026-10-25T17:50:06.907763985+00:00"},"epss":{"cve":"CVE-2026-55773","score":0.00518,"percentile":0.43771,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-qmch-v2q9-wg4p","url":"https://osv.dev/vulnerability/GHSA-qmch-v2q9-wg4p","summary":"CedarJava has policy injection vulnerability","modified":"2026-07-28T02:00:32.809400490Z","packages":[{"ecosystem":"Maven","name":"com.cedarpolicy:cedar-java","purl":"pkg:maven/com.cedarpolicy/cedar-java","ranges":["<2.3.6"],"fixed":["2.3.6"]},{"ecosystem":"Maven","name":"com.cedarpolicy:cedar-java","purl":"pkg:maven/com.cedarpolicy/cedar-java","ranges":[">=3.1.2 <3.4.1"],"fixed":["3.4.1"]},{"ecosystem":"Maven","name":"com.cedarpolicy:cedar-java","purl":"pkg:maven/com.cedarpolicy/cedar-java","ranges":[">=4.0.0 <4.9.0"],"fixed":["4.9.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}