AIKIDO-2026-194907
mockserver-core is vulnerable to Remote Code Execution (RCE)
79
High Risk
This Affects:
mockserver-coreTL;DR
MockServer builds dynamic responses by evaluating user-registered response templates through its Velocity and JavaScript (GraalVM) template engines. A caller who can reach the management API registers an expectation whose template resolves arbitrary Java classes, loading java.lang.Runtime to run operating-system commands inside the MockServer process. Velocity class loading is permitted by default in every distribution and the GraalJS context binds host objects with full access, so template evaluation escalates the management API into code execution. The fix disables Velocity class loading by default, denies Java class resolution in JavaScript templates unless explicitly allowed, and restricts the GraalJS host classloader and member access.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and the MockServer management API is reachable by callers who can register response template expectations.
Background info
mockserver-core is vulnerable to Remote Code Execution (RCE) in versions 0.0.1 - 7.4.0.
How to fix this
Upgrade the org.mock-server:mockserver-core library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant