Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Sandbox escape in the JavaScript Task feature of Google Cloud Application Integration allows an actor to execute arbitrary unsandboxed code via crafted JavaScript code executed by the Rhino engine. Effective January 24, 2025, Application Integration will no longer support Rhino as the JavaScript execution engine. No further fix actions are needed.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
이 글에서는 Google Cloud의 애플리케이션 통합 서비스에서 발견한 샌드박스 탈출 취약점(CVE-2025-0982)을 악용한 과정을 자세히 설명합니다. 이 취약점을 통해 Google의 Borg 인프라 내에서 샌드박스를 완전히 탈출하고 임의 명령을 실행할 수 있었습니다. https://nopnop.pro/2026/08/26/escaping-google-cloud-application-integration-sandbox/
Post summary
The article explains how CVE‑2025‑0982 permits a sandbox escape on Google Cloud, detailing the steps to execute arbitrary commands and providing a link that likely contains a proof‑of‑concept.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | application_integration | - | - | - |