Apache DolphinScheduler: RCE by arbitrary js execution

CVE-2024-29831 · Published Aug 12, 2024 · updated Mar 19, 2025

High8.8

Fix: upgrade to 3.2.2 or later

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2.

Affected versions

Package	Affected	Fixed in
org.apache.dolphinscheduler:dolphinscheduler Maven	< 3.2.2	3.2.2

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from: GitHub (reviewed advisory)
Weakness: CWE-20
Also known as: CVE-2024-29831

More dolphinscheduler advisories

All dolphinscheduler

High 8.1Aug 12, 2024

Apache DolphinScheduler: Resource File Read And Write VulnerabilityCVE-2024-30188fixed in 3.2.2 High 7.3Feb 20, 2024

Improper Certificate Validation in Apache DolphinSchedulerCVE-2023-49250fixed in 3.2.1 High 7.5Feb 20, 2024

Arbitrary File Read Vulnerability in Apache DolphinschedulerCVE-2023-51770fixed in 3.2.1 MediumFeb 20, 2024

Session Fixation Apache DolphinSchedulerCVE-2023-50270fixed in 3.2.1 Critical 9.8Feb 20, 2024

Remote Code Execution in Apache DolphinschedulerCVE-2023-49109fixed in 3.2.1 High 7.5Nov 24, 2023

Apache DolphinScheduler sensitive information disclosureCVE-2023-48796fixed in 3.0.2