HummerRisk vulnerabilities
We track 6 vulnerabilities in HummerRisk products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on February 24, 2026.
Latest HummerRisk vulnerabilities
- 8.8 High severity
HummerRisk: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability has been found in HummerRisk up to 1.5.0. This issue affects the function extractTarGZ/extractZip of the file hummer-common/hummer-common-core/src/main/java/com/hummer/common/core/utils/CommandUtils.java of the component Archive Extraction. The
- 8.8 High severity
HummerRisk: Improper Neutralization of Special Elements used in a Command
A flaw has been found in HummerRisk up to 1.5.0. This vulnerability affects the function fixedCommand of the file hummer-common/hummer-common-core/src/main/java/com/hummer/common/core/utils/PlatformUtils.java of the component Cloud Compliance Scanning. Executi
- 8.8 High severity
HummerRisk: Improper Neutralization of Special Elements used in a Command
A vulnerability was detected in HummerRisk up to 1.5.0. This affects the function CommandUtils.commonExecCmdWithResult of the file CloudTaskService.java of the component Cloud Task Dry-run. Performing a manipulation of the argument fileName results in command
- 8.8 High severity
HummerRisk: Improper Neutralization of Special Elements used in a Command
A security vulnerability has been detected in HummerRisk up to 1.5.0. Affected by this issue is some unknown functionality of the file ResourceCreateService.java of the component Cloud Task Scheduler. Such manipulation of the argument regionId leads to command
- 8.8 High severity
Hummerrisk: Deserialization of Untrusted Data
HummerRisk thru v1.5.0 is using a vulnerable Snakeyaml component, allowing attackers with normal user privileges to hit the /rule/add API and thereby achieve RCE and take over the server.
- 8.8 High severity
Hummerrisk: Improper Control of Generation of Code
An issue in HummerRisk HummerRisk v.1.10 thru 1.4.1 allows an authenticated attacker to execute arbitrary code via a crafted request to the service/LicenseService component.