🚨 HIGH - Logback conditional config arbitrary code execution bypass (CVE-2026-13006) An arbitrary code execution vulnerability exists in http://QOS.CH logback-core’s conditional configuration file processing (logback.xml / logback-test.xml) up to and including 1.5.34, enabling a bypass of protections introduced for CVE-2025-11226. The root cause is improper input validation / sandbox bypass in conditional evaluation when Janino is available, allowing attacker-controlled expressions or configuration logic to be evaluated. An attacker can exploit this if Janino is on the classpath and they already have the ability to write/modify a Logback configuration file or inject an environment variable/property that points Logback to a malicious configuration file. If exploited, this results in arbitrary code execution in the context of the running Java process, enabling full application compromise, data access, and potential lateral movement. 👉 Affected: logback-core <= 1.5.34 | Upgrade to 1.5.35 or later
Post summary
CVE‑2026‑13006 is a high‑severity arbitrary code execution vulnerability in logback‑core up to 1.5.34, mitigated by upgrading to version 1.5.35 or later.