{"data":{"id":"08c4f7b8-e2b5-42d4-a94b-98e96a264e99","title":"CVE-2024-37902: DeepJavaLibrary(DJL) is an Engine-Agnostic Deep Learning Framework in Java. DJL versions 0.1.0 through 0.27.0 do not…","summary":"CVE-2024-37902 affects DeepJavaLibrary (DJL) versions 0.1.0 through 0.27.0, an engine-agnostic deep learning framework in Java. The flaw lets absolute path archived artifacts insert archived files directly into the system, overwriting system files. The CWE is CWE-22, Improper Limitation of a Pathname to a Restricted Directory.","solution":"This is fixed in DJL 0.28.0 and patched in DJL Large Model Inference containers version 0.27.0. Users are advised to upgrade.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-37902","publishedAt":"2024-06-17T20:15:14.463Z","cveId":"CVE-2024-37902","cweIds":["CWE-22"],"cvssScore":"10","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["ai.djl:api@>= 0.1.0, < 0.28.0 (fixed: 0.28.0)"],"affectedPackageNames":["ai-djl:api"],"affectedPackageRefs":["maven:ai-djl:api"],"affectedVendors":[],"affectedVendorsRaw":["DeepJavaLibrary (DJL)"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"DeepJavaLibrary (DJL) path traversal via absolute path archived artifacts","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00784,"epssCheckedAt":"2026-11-04T18:09:13.386Z","kevDateAdded":null,"advisoryAliases":["GHSA-w877-jfw7-46rj"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:55:41.767Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":"2026-10-29T21:45:44.411Z","capecIds":["CAPEC-126"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":null,"name":"ai.djl:api","fixedVersion":"0.28.0","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":null,"source":null,"status":"ecosystem_unknown","checkedAt":"2026-10-29T21:45:44.260Z"}]}}