Improper Neutralization of Expression/Command Delimiters in Apache Commons OGNL

CVE-2025-53192

What is CVE-2025-53192?

The Apache Commons OGNL library suffers from an improper neutralization of expression/command delimiters, posing a risk of arbitrary code execution. This vulnerability arises when the API Ognl.getValue​ evaluates user-provided expressions, allowing attackers to exploit the OGNL engine's parsing capabilities. Despite OgnlRuntime's attempts to restrict access to dangerous classes and methods through a blocklist, the limitations are not exhaustive. Attackers can potentially circumvent these restrictions using class objects not included on the blocklist. As the Apache Commons OGNL project is retired, there will be no further fixes; users are advised to seek alternative solutions or limit access to trusted users.

References