CVE-2022-41853

CVE-2022-41853 is a critical remote code execution vulnerability affecting HyperSQL Database (hsqldb) versions prior to 2.7.1, including those bundled in Debian. It allows attackers to execute arbitrary code by exploiting the default behavior of java.sql.Statement or java.sql.PreparedStatement when processing untrusted input, as any static Java method in the classpath can be called. With a CVSS score of 9.8 (Critical), this vulnerability is easily exploitable over the network without authentication, leading to complete compromise of confidentiality, integrity, and availability. While no active exploitation, public exploit code, or significant community discussion has been observed, immediate patching to version 2.7.1 or implementing the recommended system property "hsqldb.method_class_names" is crucial to mitigate this high-risk threat.