Deserialization Flaw in Pentaho Data Integration and Analytics Dashboard Editor Plugin

CVE-2025-9121

What is CVE-2025-9121?

The Pentaho Data Integration and Analytics Community Dashboard Editor plugin contains a vulnerability that allows an attacker to exploit the deserialization of untrusted JSON data. This occurs because the parser is not constrained to approved classes and methods, exposing the system to potential malicious attacks. Versions prior to 10.2.0.4, including 9.3.0.x and 8.3.x, are particularly susceptible.

References