CVE-2024-50611: Cyclonedx Cdxgen

High severity, CVSS 7.2. EPSS: 0.8% chance of exploitation in the next 30 days.

CycloneDX cdxgen through 10.10.7, when run against an untrusted codebase, may execute code contained within build-related files such as build.gradle.kts, a similar issue to CVE-2022-24441. cdxgen is used by, for example, OWASP dep-scan. NOTE: this has been characterized as a design limitation, rather than an implementation mistake.

Affected products

• Cyclonedx Cdxgen: up to and including 10.10.7

Published 2024-10-27. Last modified 2026-06-17.