CVE-2025-56819
Published: 24 September 2025
Summary
CVE-2025-56819 is a critical-severity OS Command Injection (CWE-78) vulnerability in Running-Elephant Datart. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 6.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-56819 is a critical remote code execution vulnerability in Datart version 1.0.0-rc.3 that stems from unsafe handling of the INIT connection parameter. The flaw is tracked under CWE-78 and carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation with no required credentials or user interaction. The affected component appears tied to an embedded H2 database instance, whose RUNSCRIPT feature is exposed through the INIT parameter.
An unauthenticated remote attacker can supply a malicious INIT value when establishing a database connection, causing the H2 engine to execute arbitrary operating-system commands or scripts under the privileges of the Datart process. Successful exploitation grants full confidentiality, integrity, and availability impact on the target system.
Public references include the H2 database repository, documentation on its RUNSCRIPT capability, and a dedicated proof-of-concept repository. No vendor advisory or patch details are listed among the top references. The EPSS score reached a peak of 0.2068 after disclosure, indicating a clear rise in observed exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-31018
Vulnerability details
An issue in Datart v.1.0.0-rc.3 allows a remote attacker to execute arbitrary code via the INIT connection parameter.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables remote code execution via a crafted 'INIT' parameter in a JDBC URL sent to the unauthenticated /api/v1/data-provider/test endpoint of the public-facing Datart web application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents OS command injection by validating and sanitizing untrusted inputs like the INIT connection parameter in Datart.
Requires timely flaw remediation to patch the specific command injection vulnerability in Datart v1.0.0-rc.3.
Enforces least functionality to disable unnecessary and risky features like H2 Database's INIT RUNSCRIPT capability exploited in this CVE.