Unsafe Reflection

org.apache.calcite.avatica, avatica-core is vulnerable to unsafe reflection. The vulnerability is due to unrestricted calls to Class.forNameString during plugin instantiation, which allows an attacker to potentially trigger the execution of static initializer blocks in arbitrary classes available...