Critical severity · published Feb 6, 2025
CVE-2025-0982
Sandbox Escape in Google Cloud Application Integration's JavaScript Task (Rhino Engine)
10.0
CVSS
0.3%
EPSS
No
On KEV
Description
Sandbox escape in the JavaScript Task feature of Google Cloud Application Integration allows an actor to execute arbitrary unsandboxed code via crafted JavaScript code executed by the Rhino engine. Effective January 24, 2025, Application Integration will no longer support Rhino as the JavaScript execution engine. No further fix actions are needed.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Application Integration · Google Cloud
0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0982
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0982
Release Notes
https://cloud.google.com/application-integration/docs/release-notes#January_23_2025
More from Application Integration
9.4
CVE-2026-81867
Deserialization of Untrusted Data in Application Integration allows Remote Code Execution
9.4
CVE-2026-19759
Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution
9.3
CVE-2026-12710
Missing Authorization in Application Integration QueryEngineTask
8.3
CVE-2026-81375
Confused Deputy in Application Integration allows Internal File Read
7.3
CVE-2026-85298
Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation