CVE-2025-0982: critical vulnerability in Google Cloud Application Integration
Sandbox Escape in Google Cloud Application Integration's JavaScript Task (Rhino Engine)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.4epss 0.3%
Sandbox escape in the JavaScript Task feature of Google Cloud Application Integration allows an actor to execute arbitrary unsandboxed code via crafted JavaScript code executed by the Rhino engine. Effective January 24, 2025, Application Integration will no longer support Rhino as the JavaScript execution engine. No further fix actions are needed.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Affected products
Google Cloud · Application IntegrationRelated CVEs — Google Cloud Application Integration
In the same product, most dangerous first.
CVE-2026-12710CRITICALMissing Authorization in Application Integration QueryEngineTaskEPSS 0.4%CVE-2026-93327CRITICALUnsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code ExecutionEPSS 0.4%CVE-2026-85298HIGHImproper Authorization in Google Cloud Application Integration Leads to Privilege EscalationEPSS 0.4%CVE-2026-81867CRITICALDeserialization of Untrusted Data in Application Integration allows Remote Code ExecutionEPSS 0.4%CVE-2026-81375HIGHConfused Deputy in Application Integration allows Internal File ReadEPSS 0.3%CVE-2026-19759CRITICALIncorrect Authorization in Application Integration allows Internal Stubby RPC ExecutionEPSS 0.2%