CVE-2026-55773
Deferred
Deferred - Pending Action
CedarJava Cedar Expression Injection via toCedarExpr
Vulnerability report for CVE-2026-55773, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-07-13
Last updated on: 2026-07-13
Assigner: GitHub, Inc.
Description
Description
CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Cedar-expression injection via unescaped toCedarExpr(). The toCedarExpr() method on Cedar Value types does not escape special characters (" or \) when converting values to Cedar source code. If an integrator uses toCedarExpr() to build policy text at runtime from user-controlled values, an actor could inject arbitrary Cedar expressions. For example, injecting || true into a permit ... when { ... } clause could make the permit unconditional, or injecting && false into a forbid clause could prevent the forbid from triggering. This issue requires the integrator to use toCedarExpr() to build policy text at runtime from user-controlled input. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.0.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cedar-policy | cedarjava | to 2.3.6 (exc) |
| cedar-policy | cedarjava | to 3.4.1 (exc) |
| cedar-policy | cedarjava | to 4.9.0 (exc) |
| cedar-policy | cedarjava | 2.3.6 |
| cedar-policy | cedarjava | 3.4.1 |
| cedar-policy | cedarjava | 4.9.0 |
| cedarjava | cedarjava | to 2.3.6 (exc) |
| cedarjava | cedarjava | to 3.4.1 (exc) |
| cedarjava | cedarjava | to 4.9.0 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
