Google Apigee hybrid Javacallout policy 安全漏洞

Google Apigee hybrid Javacallout policy is a next-generation API management platform from Google, Inc USA. A security vulnerability exists in Google Apigee hybrid Javacallout policy that stems from a JavaCallout policy that allows the injection of malicious objects, which could lead to remote cod...

CVE-2025-13426: Improper Control of Dynamically-Managed Code Resources

A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remote code execution. It is possible for a user to write a JavaCallout that injected a malicious object into the MessageContext to execute...