CVE-2022-25842

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

All versions of package com.alibaba.oneagent:one-java-agent-plugin are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe). The attacker can overwrite executable files and either invoke them remotely or wait for the system or user to call them, thus achieving remote command execution on the victim’s machine.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: May 1, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-258447.5The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes CVE-2022-258459.8The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdow CVE-2022-258476.1All versions of the package serve-lite are vulnerable to Cross-site Scripting (XSS) because when it detects a request to a directory, it ren CVE-2022-258487.5This affects all versions of package static-dev-server. This is because when paths from users to the root directory are joined, the assets f CVE-2022-258496.1The package joyqi/hyper-down from 0.0.0 are vulnerable to Cross-site Scripting (XSS) because the module of parse markdown does not filter th CVE-2022-25857.8It was discovered that when exec'ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-af CVE-2022-258507.5The package github.com/hoppscotch/proxyscotch before 1.0.0 are vulnerable to Server-side Request Forgery (SSRF) when interceptor mode is set CVE-2022-258517.5The package jpeg-js before 0.4.4 are vulnerable to Denial of Service (DoS) where a particular piece of input will cause to enter an infinite CVE-2022-258527.5All versions of package pg-native; all versions of package libpq are vulnerable to Denial of Service (DoS) when the addons attempt to cast t CVE-2022-258537.8All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitiza CVE-2022-258545.4This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and a CVE-2022-258557.8All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sani