CVE-2024-29831

8.8 highEPSS 1.2%

High (8.8) in apache dolphinscheduler. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in org.apache.dolphinscheduler:dolphinscheduler 3.2.2.

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2024-08-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:dolphinscheduler

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-m9q4-p56m-mc6q	Maven	org.apache.dolphinscheduler:dolphinscheduler	<3.2.2	3.2.2

References

https://lists.apache.org/thread/x1ch0x5om3srtbnp7rtsvdszho3mdrq0
http://www.openwall.com/lists/oss-security/2024/08/09/6

Check your stack JSON