CVE-2021-21248

CVE-2021-21248 is a critical arbitrary code execution vulnerability affecting OneDev versions prior to 4.0.3. An authenticated attacker can inject malicious Groovy code into build job parameters, leading to the execution of arbitrary code on the OneDev server. This vulnerability has a high severity CVSS score of 8.8, indicating a low attack complexity and significant potential for complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation, public exploit code, or significant community discussion, the nature of the flaw warrants immediate patching.