Recommended action

Update org.python:jython to 2.7.1b3; org.python:jython-standalone to 2.7.1b3 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

Deserialization of Untrusted Data in Jython affects org.python:jython (maven), org.python:jython-standalone (maven). Severity is critical. Jython before 2.7.1b3 allows attackers to execute arbitrary code via a crafted serialized PyFunction object.

AI coding agents often install or upgrade packages automatically in maven. A critical vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software

Recommended action

Update org.python:jython to 2.7.1b3; org.python:jython-standalone to 2.7.1b3 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

Deserialization of Untrusted Data in Jython affects org.python:jython (maven), org.python:jython-standalone (maven). Severity is critical. Jython before 2.7.1b3 allows attackers to execute arbitrary code via a crafted serialized PyFunction object.

AI coding agents often install or upgrade packages automatically in maven. A critical vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software