Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modules/airag/llm/controller/AiragKnowledgeController.java of the component Retrieval-Augmented Generation. Executing a manipulation can lead to deserialization. The attack can be launched remotely. Attacks of this nature are highly complex. It is stated that the exploitability is difficult. The project was informed of the problem early through an issue report but has not responded yet.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-2555 A weakness has been identified in JeecgBoot 3.9.1. This vulnerability affects the function importDocumentFromZip of the file org/jeecg/modules/airag/llm/controller/Aira… https://www.cve.org/CVERecord?id=CVE-2026-2555
Post summary
The text reports a newly identified weakness in JeecgBoot 3.9.1 affecting importDocumentFromZip, without providing details on exploitation, mitigation, or technical specifics.
CVE-2026-2555 Deserialization Vulnerability in JeecgBoot 3.9.1 Retrieval-Augmented Generation Component https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-2555
Post summary
The text announces a deserialization vulnerability (CVE‑2026‑2555) in JeecgBoot 3.9.1 with a link to a vulnerability database entry, but provides no PoC, exploit code, active exploitation evidence, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | jeecg | jeecg_boot | 3.9.1 | - | - |