CVE-2026-55773

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-55773", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-17T14:34:51.881Z", "datePublished": "2026-07-13T19:17:03.552Z", "dateUpdated": "2026-07-15T14:18:27.118Z"}, "containers": {"cna": {"title": "CedarJava has a policy injection vulnerability", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/cedar-policy/cedar-java/security/advisories/GHSA-qmch-v2q9-wg4p", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/cedar-policy/cedar-java/security/advisories/GHSA-qmch-v2q9-wg4p"}], "affected": [{"vendor": "cedar-policy", "product": "cedar-java", "versions": [{"version": "< 2.3.6", "status": "affected"}, {"version": ">= 3.1.2, < 3.4.1", "status": "affected"}, {"version": ">= 4.0.0, < 4.9.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-13T19:17:03.552Z"}, "descriptions": [{"lang": "en", "value": "CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Cedar-expression injection via unescaped toCedarExpr(). The toCedarExpr() method on Cedar Value types does not escape special characters (\" or \\) when converting values to Cedar source code. If an integrator uses toCedarExpr() to build policy text at runtime from user-controlled values, an actor could inject arbitrary Cedar expressions. For example, injecting || true into a permit ... when { ... } clause could make the permit unconditional, or injecting && false into a forbid clause could prevent the forbid from triggering. This issue requires the integrator to use toCedarExpr() to build policy text at runtime from user-controlled input. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.0."}], "source": {"advisory": "GHSA-qmch-v2q9-wg4p", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-15T14:18:12.881386Z", "id": "CVE-2026-55773", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T14:18:27.118Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-55773", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-15T14:18:12.881386Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-15T14:18:21.259Z"}}], "cna": {"title": "CedarJava has a policy injection vulnerability", "source": {"advisory": "GHSA-qmch-v2q9-wg4p", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "cedar-policy", "product": "cedar-java", "versions": [{"status": "affected", "version": "< 2.3.6"}, {"status": "affected", "version": ">= 3.1.2, < 3.4.1"}, {"status": "affected", "version": ">= 4.0.0, < 4.9.0"}]}], "references": [{"url": "https://github.com/cedar-policy/cedar-java/security/advisories/GHSA-qmch-v2q9-wg4p", "name": "https://github.com/cedar-policy/cedar-java/security/advisories/GHSA-qmch-v2q9-wg4p", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Cedar-expression injection via unescaped toCedarExpr(). The toCedarExpr() method on Cedar Value types does not escape special characters (\" or \\) when converting values to Cedar source code. If an integrator uses toCedarExpr() to build policy text at runtime from user-controlled values, an actor could inject arbitrary Cedar expressions. For example, injecting || true into a permit ... when { ... } clause could make the permit unconditional, or injecting && false into a forbid clause could prevent the forbid from triggering. This issue requires the integrator to use toCedarExpr() to build policy text at runtime from user-controlled input. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-13T19:17:03.552Z"}}}, "cveMetadata": {"cveId": "CVE-2026-55773", "state": "PUBLISHED", "dateUpdated": "2026-07-15T14:18:27.118Z", "dateReserved": "2026-06-17T14:34:51.881Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-13T19:17:03.552Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "cedar-java", "vendor": "cedar-policy", "versions": [{"status": "affected", "version": "< 2.3.6"}, {"status": "affected", "version": ">= 3.1.2, < 3.4.1"}, {"status": "affected", "version": ">= 4.0.0, < 4.9.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Cedar-expression injection via unescaped toCedarExpr(). The toCedarExpr() method on Cedar Value types does not escape special characters (\" or \\) when converting values to Cedar source code. If an integrator uses toCedarExpr() to build policy text at runtime from user-controlled values, an actor could inject arbitrary Cedar expressions. For example, injecting || true into a permit ... when { ... } clause could make the permit unconditional, or injecting && false into a forbid clause could prevent the forbid from triggering. This issue requires the integrator to use toCedarExpr() to build policy text at runtime from user-controlled input. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.0."}, {"lang": "es", "value": "CedarJava es una implementaci\u00f3n Java de c\u00f3digo abierto del lenguaje de pol\u00edticas Cedar, utilizada para decisiones de autorizaci\u00f3n de grano fino. En versiones anteriores a la 2.3.6, 3.4.1 y 4.9.0, bajo ciertas circunstancias, un manejo inadecuado de la entrada podr\u00eda permitir la inyecci\u00f3n de expresiones Cedar a trav\u00e9s de toCedarExpr() sin escape. El m\u00e9todo toCedarExpr() en los tipos de valor Cedar no escapa caracteres especiales (\u201d o \\) al convertir valores a c\u00f3digo fuente Cedar. Si un integrador utiliza toCedarExpr() para construir texto de pol\u00edtica en tiempo de ejecuci\u00f3n a partir de valores controlados por el usuario, un actor podr\u00eda inyectar expresiones Cedar arbitrarias. Por ejemplo, inyectar || true en una cl\u00e1usula permit ... when { ... } podr\u00eda hacer que el permiso sea incondicional, o inyectar && false en una cl\u00e1usula forbid podr\u00eda evitar que el forbid se active. Este problema requiere que el integrador utilice toCedarExpr() para construir texto de pol\u00edtica en tiempo de ejecuci\u00f3n a partir de entrada controlada por el usuario. Esta vulnerabilidad ha sido corregida en las versiones 2.3.6, 3.4.1 y 4.9.0."}], "id": "CVE-2026-55773", "lastModified": "2026-10-24T22:10:00.210", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-55773", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-15T14:18:12.881386Z", "version": "2.0.3"}}]}, "published": "2026-07-13T20:16:48.580", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/cedar-policy/cedar-java/security/advisories/GHSA-qmch-v2q9-wg4p"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.3.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.1.2,3.4.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0,4.9.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "cedar-java", "source": "cna", "vendor": "cedar-policy"}, "product": "cedar-java", "vendor": "cedar-policy"}], "created": "2026-07-14T13:15:10.624404+00:00", "updated": "2026-07-31T11:30:05.202331+00:00", "vendors": ["cedar-policy", "cedar-policy$PRODUCT$cedar-java"]}