Hello,
There is a security vulnerability in Nashorn within the JDK, which can be
exploited to access any Java object in a restricted Nashorn execution
environment (specifically, it refers to the use of --no-java or
ClassFilter),thereby achieving arbitrary code execution.
Details:
- CVE: CVE-2025-30761
- Subsystem: JDK Nashorn
- Impact: Bypassing security restrictions in a restricted Nashorn execution
environment, accessing any Java object, and achieving arbitrary code execution
- Affected versions: Oracle Java SE: 8u451, 8u451-perf, 11.0.27; Oracle GraalVM
Enterprise Edition: 21.3.14
- Fixed in: It is recommended to upgrade to a JDK version that includes the fix
patch.
Description:
In JDK8 - JDK14, Nashorn has always been the built-in JavaScript Engine for
Java.
It not only allows dynamic parsing of js in Java, but also allows access to
Java classes from within js.
```
ScriptEngine engine0 = new ScriptEngineManager().getEngineByName("nashorn");
String cmd = "Java.type('java.lang.Runtime').getRuntime().exec('calc');";
engine0.eval(cmd);
```
This code will execute the calc system command and bring up the calculator.
For enhance security, in Nashorn's documentation, there is a `--no-java` option
that prohibits access to Java classes from JavaScript.
```
System.setProperty("nashorn.args", "--no-java");
ScriptEngine engine0 = new ScriptEngineManager().getEngineByName("nashorn");
String cmd = "Java.type('java.lang.Runtime').getRuntime().exec('calc');";
engine0.eval(cmd);
```
This code will throw an exception:"Java" is not defined
The researcher discovered a way to bypass the --no-java security restriction,
allowing unrestricted access to Java objects and the execution of arbitrary
code. It is worth mentioning that this bypass way also applies to ClassFilter,
another security mechanism added to Nashorn by the JDK in JEP202.
Credit:
Tianyi Cheng(chengtia...@huawei.com)
Reference:
https://nvd.nist.gov/vuln/detail/CVE-2025-30761
https://www.oracle.com/security-alerts/cpujul2025.html
Best regards,
Yajie Li
