CVE-2025-0982

9.4 criticalEPSS 0.3%

Critical (9.4) in google application integration. EPSS 0.3% chance of exploitation in the next 30 days.

Sandbox escape in the JavaScript Task feature of Google Cloud Application Integration allows an actor to execute arbitrary unsandboxed code via crafted JavaScript code executed by the Rhino engine. Effective January 24, 2025, Application Integration will no longer support Rhino as the JavaScript execution engine. No further fix actions are needed.

Severity

CVSS 4.0

9.4 critical

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

CVSS 3.1

10.0 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-31)
CWE: CWE-829
Published: 2025-02-06
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

google:application_integration

References

https://cloud.google.com/application-integration/docs/release-notes#January_23_2025

Check your stack JSON