A critical command injection vulnerability in Jeecg Boot allows unauthenticated remote attackers to execute arbitrary system commands.

The vulnerability exists in the /jmreport/show component, which fails to properly sanitize user-supplied input. This allows for command injection, enabling an unauthenticated remote attacker to execute arbitrary commands on the underlying host operating system.

This vulnerability carries a CVSS score of 9.8, signifying a critical risk. Successful exploitation results in full system compromise, allowing attackers to exfiltrate database contents, manipulate application logic, or use the server as a pivot point for further attacks on the internal network.

Immediate Action: Update Jeecg Boot to the latest stable version provided by the vendor to remediate the command injection flaw.

Proactive Monitoring: Monitor server logs for suspicious process execution spawned by web application services and watch for unauthorized outbound network connections from the application server.

Compensating Controls: Deploy a WAF configured to block shell-related characters and command patterns in HTTP requests directed at the /jmreport/show endpoint.

Public Exploit Available: No (no confirmed weaponized exploit or public PoC in available data).

Given the critical nature of command injection, immediate remediation is required. Organizations should identify all deployments of Jeecg Boot within their infrastructure and apply the latest security patches to mitigate this significant remote code execution risk.