CVE-2023-34112: Bytedeco Javacpp Presets

High severity, CVSS 8.8. EPSS: 2% chance of exploitation in the next 30 days.

JavaCPP Presets is a project providing Java distributions of native C++ libraries. All the actions in the `bytedeco/javacpp-presets` use the `github.event.head_commit.message​` parameter in an insecure way. For example, the commit message is used in a run statement - resulting in a command injection vulnerability due to string interpolation. No exploitation has been reported. This issue has been addressed in version 1.5.9. Users of JavaCPP Presets are advised to upgrade as a precaution.

Affected products

• Bytedeco Javacpp Presets: before 1.5.9 (fixed in 1.5.9)

Published 2023-06-09. Last modified 2026-06-17.