AJ-Report: remote code execution

anji-plus AJ-Report

AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution.

Do this now

No source names a fix yet: limit who can reach anji-plus AJ-Report until one does.

Still cooking for AJ-Report.

First seen: 6 Nov 2026
Last update: 6 Nov 2026, 12:17 UTC
Identifiers: CVE-2026-120209
CVSS: 9.8
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## AJ-Report: remote code execution
Severity: critical. Patch status: fix status unknown.
Affected: anji-plus AJ-Report
Ids: CVE-2026-120209

AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoader for unauthenticated remote code execution.

## Steps
1. Search the repo, its CI and infra config for anji-plus AJ-Report. If present, report the version in use and whether it's affected.
2. AJ-Report <= 1.7.1: the CVE record names no fix; check the vendor advisory before assuming there is none. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| AJ-Report <= 1.7.1 | not named in the CVE record | check the vendor advisory: https://gitee.com/belief-team/report | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-120209") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://gitee.com/belief-team/report https://nvd.nist.gov/vuln/detail/CVE-2026-120209
https://pwned.coffee/i/aj-report-remote-code-execution-cve-2026-120209

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
AJ-Report <= 1.7.1 fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 6 Nov
The CVE record names no fix for one line; the vendor’s advisory may: gitee.com
Score: CVSS 9.8 (critical). CVSS 3.1 9.8 (CNA VulnCheck) for CVE-2026-120209
Last checked: 6 Nov 2026, 12:18 UTC

Product	Affected	Fixed in	Source
AJ-Report	<= 1.7.1	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 6 Nov

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Follow on X

Totalone very hot coffee