{"id":"ghsa-ghsa-crwc-vw2r-qr6m","seq":32750,"kind":"advisory","title":"OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxies","url":"https://github.com/advisories/GHSA-crwc-vw2r-qr6m","permalink":"https://vulnpulse.app/items/ghsa-ghsa-crwc-vw2r-qr6m","summary":"影響: maven:ognl:ognl <= 3.4.12 → 3.4.13\nSummary OGNL's optional stricter invocation mode maintains a block list that prevents expressions from directly calling methods on dangerous classes such as Runtime, ProcessBuilder, and ClassLoader. The block list filters on the declaring class of the method OGNL invokes. Because java.lang.reflect.Method (and Constructor/Field) are not on the list, an expression can use reflection as a proxy — someMethod.invoke(target, args) — to reach a blocked method. The real call (e.g. ProcessBuilder.start(…","severity":"medium","techs":["java"],"cves":["CVE-2026-113730"],"tags":["GHSA-crwc-vw2r-qr6m","ognl:ognl"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-21T16:31:04.000Z","fetched_at":"2026-10-21T18:28:52.985Z"}