CVE-2022-25842: Path Traversal in com.alibaba.oneagent:one-java-agent-plugin
Summary
CVE-2022-2584: Panic when decoding invalid blocks in github.com/ipld/go-codec-dagpb. Affects github.com/ipld/go-codec-dagpb versions < 1.3.1. Fixed in 1.3.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com.alibaba.oneagent:one-java-agent-plugin package is a Maven ecosystem package that provides functionality for the Alibaba OneAgent Java agent plugin. This plugin is used for monitoring and tracing Java applications. It allows users to collect performance metrics, trace requests, and monitor the health of their Java applications. The package is widely used in various Java applications.
Vulnerability Detail
The package com.alibaba.oneagent:one-java-agent-plugin is vulnerable to a Path Traversal vulnerability, also known as Zip Slip. This vulnerability allows an attacker to perform arbitrary file write operations by exploiting a flaw in the archive extraction process. By crafting a specially crafted archive with directory traversal filenames (e.g., ../../evil.exe), an attacker can overwrite executable files on the victim's machine. This can lead to remote command execution on the victim's machine, enabling the attacker to execute arbitrary commands with the privileges of the user running the affected application. The vulnerability has a CVSSv3 score of 6.9, indicating a moderate severity.
How To Fix
Latest published version: v1.7.0 as of 22 Oct 2026
go get github.com/ipld/go-codec-dagpb@v1.7.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.1
This is the first release that contains the fix.
go get github.com/ipld/go-codec-dagpb@v1.3.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the package as soon as possible.
Conclusion
The com.alibaba.oneagent:one-java-agent-plugin package is vulnerable to a Path Traversal vulnerability that allows arbitrary file write operations. It is crucial to upgrade to version 0.0.2 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for github.com/ipld/go-codec-dagpb →
FAQ
This vulnerability allows an attacker to overwrite executable files on the victim's machine, potentially leading to remote command execution.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. The playground allows you to analyze your pom.xml file and provides real-time alerts for open-source vulnerabilities.
There are currently no known public exploits for this vulnerability. However, it is important to patch your application as soon as possible to prevent potential attacks.
Yes, the CVSSv3 score for this vulnerability is 6.9, indicating a moderate severity.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-9hr3-j9mc-xmq2/GHSA-9hr3-j9mc-xmq2.json).
