Cpe:2.3:a:halo_dev:halo:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3ahalo_devhalo/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 24 Sep 2026 14:47:13 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgImproper Neutralization Vulnerability in Halo SpEL Handlerhttps://feed.craftedsignal.io/briefs/2026-09-cve-2026-97182/Thu, 24 Sep 2026 14:47:13 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-cve-2026-97182/Halo versions 2.25.4/2.26.1 and prior contain a critical vulnerability in the SpEL Handler component, allowing remote unauthenticated attackers to achieve remote code execution through improper expression neutralization.A security vulnerability identified as CVE-2026-97182 affects Halo versions 2.25.4/2.26.1 and prior. The vulnerability resides within the ReplyNotificationSubscriptionHelper.java component, specifically related to the handling of Spring Expression Language (SpEL) expressions. An unauthenticated remote attacker can exploit this flaw by manipulating input parameters passed to the notification subscription function. Because the input is not properly neutralized, the application interprets the malicious input as a SpEL expression, which the underlying framework executes. This leads to arbitrary code execution on the server hosting the Halo instance. Publicly disclosed exploit code currently exists, and the vendor has not provided a responsive update to the disclosure. Defenders should prioritize isolating affected Halo instances or implementing strict input validation at the web application firewall (WAF) layer until patches are available.

Impact

The vulnerability allows for unauthenticated remote code execution, which grants the attacker full control over the application server. This can lead to total system compromise, data exfiltration, or the deployment of persistent threats such as web shells or ransomware within the organization's network environment.

Recommendation

  • Implement strict input validation or request filtering on all traffic directed to the Halo API endpoints associated with notification subscriptions.
  • Monitor web server logs for HTTP requests containing common SpEL injection characters such as #{, }, T(, or Class.forName.
  • Ensure the application service account runs with the principle of least privilege, specifically limiting execution permissions and file system access.
  • Block or restrict access to the Halo management interface from non-trusted networks until the vulnerability is addressed by the vendor.
]]>highadvisoryvulnerabilityrcewebserver