CVE-2021-21248: Onedev Project Onedev

High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days.

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability involving the build endpoint parameters. InputSpec is used to define parameters of a Build spec. It does so by using dynamically generated Groovy classes. A user able to control job parameters can run arbitrary code on OneDev's server by injecting arbitrary Groovy code. The ultimate result is in the injection of a static constructor that will run arbitrary code. For a full example refer to the referenced GHSA. This issue was addressed in 4.0.3 by escaping special characters such as quote from user input.

Affected products

• Onedev Project Onedev: before 4.0.3 (fixed in 4.0.3)

Published 2021-01-15. Last modified 2026-06-17.