---
title: "GHSA-2gh6-wc3m-g37f: hermes-management is vulnerable to RCE due to Apache commons-jxpath"
url: https://erroneo.us/security/ghsa/GHSA-2gh6-wc3m-g37f/
description: "GHSA-2gh6-wc3m-g37f (critical, Maven): hermes-management is vulnerable to RCE due to Apache commons-jxpath. Impact hermes-management is vulnerable to RCE…"
type: advisory
section: "Security Digest"
date_published: 2024-09-17
date_modified: 2026-08-31
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-2gh6-wc3m-g37f"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-2gh6-wc3m-g37f: hermes-management is vulnerable to RCE due to Apache commons-jxpath

## Affected packages

- Maven `pl.allegro.tech.hermes:hermes-management` >= 0.8.2, < 2.2.9 → fixed: 2.2.9

## Details

Impact hermes-management is vulnerable to RCE when it processes user-controlled data due to using Apache commons-jxpath. Patches Upgrade Hermes to at least hermes-2.2.9 References https://hackinglab.cz/en/blog/remote-code-execution-in-jxpath-library-cve-2022-41852/

## Sources

- [GitHub Advisory GHSA-2gh6-wc3m-g37f](https://github.com/advisories/GHSA-2gh6-wc3m-g37f)
- [github.com](https://github.com/allegro/hermes/security/advisories/GHSA-2gh6-wc3m-g37f)
- [github.com](https://github.com/allegro/hermes/commit/72ecc5aa41e37fd614443dd35d9200b66a61afb1)
- [hackinglab.cz](https://hackinglab.cz/en/blog/remote-code-execution-in-jxpath-library-cve-2022-41852)
- [github.com](https://github.com/allegro/hermes/commit/92d4ad0cf6868ba784707772b78e129fedff7a31)

---
Source page: https://erroneo.us/security/ghsa/GHSA-2gh6-wc3m-g37f/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt