maven package report

Is org.springframework.cloud:spring-cloud-contract-shade safe?

1 known vulnerability, worst severity LOW.

cvss
3.3

how bad it is if exploited, out of 10

epss
0.20%

chance of exploitation in the next 30 days

xyz score
1.1

CyberXYZ composite, out of 10

fig. 01 — GHSA-p6rp-mx85-m459, the advisory selected below

// advisories

GHSA-p6rp-mx85-m459

LOWCVE-2024-22236

In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution is vulnerable to local information disclosure via temporary directory created with unsafe permissions through the shaded com.google.guava:guava dependency in the org.springframework.cloud:spring-cloud-contract-shade dependency.

Affected
>= 3.1.0, < 3.1.10, >= 4.0.0, < 4.0.5, = 4.1.0
Fixed in
3.1.10
Weakness
CWE-377
Published
2024-01-31
Source
github

GHSANVDMITREreference

// dependencies

0 direct

Sign in for dependency paths and remediation

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so maven packages are not covered.

Checked 2026-09-22 at 03:29 UTC. The most recent advisory here was published 2024-01-31. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Think a verdict here is wrong? Tell us — we respond within 2 business days.
Is org.springframework.cloud:spring-cloud-contract-shade safe? maven package security report | CyberXYZ