Druid js vulnerability

Skill cxcscmu/SkillLearnBench/skills/b4-skill-creator-claude-opus-4-6/fix-security-bug/druid-js-vulnerability

[COLM'26] SkillLearnBench is the first benchmark for evaluating continual learning methods that automatically generate agent skills.

Install

npx -y skills add cxcscmu/SkillLearnBench --skill druid-js-vulnerability

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Patching Apache Druid JavaScript injection vulnerability (CVE-2021-25646). Use this skill when fixing Druid's JavaScript execution bypass where empty JSON keys override @JacksonInject JavaScriptConfig to enable JavaScript execution despite being disabled server-wide.

SKILL.md

1.9 KB, 383 tokens by cl100k_base, as published. Nobody here has run it

Apache Druid JavaScript Injection Vulnerability

Affected Components

All classes that accept @JacksonInject JavaScriptConfig config in their @JsonCreator constructors:

JavaScriptDimFilter — processing module, filter package
JavaScriptExtractionFn — processing module, extraction package
JavaScriptAggregatorFactory — processing module, aggregation package
JavaScriptPostAggregator — processing module, post-aggregation package
JavaScriptParseSpec — core module, data input package

Attack Vector

An authenticated user sends a POST to /druid/indexer/v1/sampler with a JSON body containing:

A JavaScript filter/aggregator/extraction function
An empty key "" with {"enabled": true} to override the injected JavaScriptConfig

This bypasses druid.javascript.enabled = false and allows arbitrary code execution via the Rhino JavaScript engine.

Fix Strategy

Change all @JacksonInject JavaScriptConfig config to:

@JacksonInject(useInput = com.fasterxml.jackson.annotation.OptBoolean.NEVER) JavaScriptConfig config

This must be applied to all 5 affected files. The fix is in two modules:

core module: JavaScriptParseSpec
processing module: JavaScriptDimFilter, JavaScriptExtractionFn, JavaScriptAggregatorFactory, JavaScriptPostAggregator

Build Command

cd /root/druid
mvn clean package -DskipTests -Dcheckstyle.skip=true -Dpmd.skip=true \
  -Dforbiddenapis.skip=true -Dspotbugs.skip=true -Danimal.sniffer.skip=true \
  -Denforcer.skip=true -Djacoco.skip=true -Ddependency-check.skip=true \
  -pl '!web-console' -pl indexing-service -am