CVE-2026-108598 is a critical code injection flaw in Floci versions 1.1.0 up to but not including 2.2.0. It lets unauthenticated attackers run OS commands through unrestricted Velocity mapping templates.
What Is It
The flaw is in Floci's VtlTemplateEngine, which processes Velocity Template Language (VTL) mapping templates for its API Gateway service. According to the NVD description, the templates are not restricted. An attacker can create a REST API with a MOCK integration whose template uses $util reflection to reach Java's Runtime or ProcessBuilder classes. The OS commands then run inside the Floci JVM.
The weakness is classified as CWE-94 (Improper Control of Generation of Code, or "Code Injection"). VulnCheck reported the CVE, and NVD published it on 2026-10-10. Its NVD status is currently "Received."
Why It Matters
VulnCheck scores this at CVSS 3.1 9.8 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and CVSS 4.0 9.3 (Critical). The attack works over the network, has low complexity, and needs no privileges or user interaction. A successful attack gives high impact to confidentiality, integrity and availability on the affected system.
The NVD references include a third-party proof-of-concept repository for this issue, which means exploit code is publicly available.
This CVE is not in the CISA Known Exploited Vulnerabilities (KEV) catalog, so the supplied data does not confirm active exploitation.
What's Vulnerable
- Vendor: floci-io
- Product: Floci (
pkg:github/floci-io/floci) - Affected versions: 1.1.0 up to but not including 2.2.0 (semver)
- Component:
VtlTemplateEnginein the API Gateway service
Versions outside this range are listed as unaffected by default.
Patch Status
A fix is available in Floci 2.2.0. The project's GitHub references include the fixing commit, the 2.2.0 release tag and a GitHub Security Advisory (GHSA-3p4c-wp7w-mgjx). Organizations running Floci 1.1.0 through any version before 2.2.0 should upgrade to 2.2.0 or later.
There is no CISA KEV entry, so no federal required action or due date applies.