Maven · repo1.maven.org
org.miaixz:bus-all
Java Jndi Lookup: JNDI / Naming.lookup — remote class-loading primitive (Log4Shell family).
Why PkgRadar flagged 8.6.13
| Severity | Signal | Evidence |
|---|---|---|
| medium | Java Jndi Lookup | JNDI / Naming.lookup — remote class-loading primitive (Log4Shell family). · org/miaixz/bus/core/lang/Keys.java |
| medium | Java Dynamic Classload | URLClassLoader / defineClass — runs attacker-provided bytecode. · org/miaixz/bus/shade/safety/boot/BootClassLoader.java |
| medium | Java Dynamic Classload | URLClassLoader / defineClass — runs attacker-provided bytecode. · org/miaixz/bus/shade/safety/boot/jar/JarClassLoader.java |
| high | Java Static Init Side Effect | Static-initializer block contains process/network/reflection — runs on first class load. · org/miaixz/bus/shade/safety/boot/BootClassLoader.java |
| high | Java Static Init Side Effect | Static-initializer block contains process/network/reflection — runs on first class load. · org/miaixz/bus/shade/safety/boot/jar/JarClassLoader.java |
| medium | Java Unsafe Deserialize | ObjectInputStream / XStream.fromXML — untrusted deserialization sink. · org/miaixz/bus/cache/serialize/JdkGzipSerializer.java |
| medium | Java Unsafe Deserialize | ObjectInputStream / XStream.fromXML — untrusted deserialization sink. · org/miaixz/bus/cache/serialize/JdkSerializer.java |
| medium | Java Dynamic Classload | URLClassLoader / defineClass — runs attacker-provided bytecode. · org/miaixz/bus/core/lang/loader/classloader/ResourceClassLoader.java |
| medium | Java Unsafe Deserialize | ObjectInputStream / XStream.fromXML — untrusted deserialization sink. · org/miaixz/bus/office/Archive.java |
| medium | Java Unsafe Deserialize | ObjectInputStream / XStream.fromXML — untrusted deserialization sink. · org/miaixz/bus/sensitive/Provider.java |
| medium | Java Process Spawn | Runtime.exec / ProcessBuilder — process spawning. · org/miaixz/bus/core/xyz/RuntimeKit.java |
| medium | Java Process Spawn | Runtime.exec / ProcessBuilder — process spawning. · org/miaixz/bus/cortex/registry/mcp/McpProcessManager.java |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
8.6.13 | High risk | 279 | 2026-06-14 |
Block this in CI
pkgradar gate --ecosystem maven org.miaixz:[email protected]