Description

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently isolate user-supplied code executed through certain REST and XDBC evaluation paths from HTTP request, response, and session state. An attacker able to execute code through an affected path could perform unauthorized actions or compromise an authenticated session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-10-12T16:17:08.223Z",
  "pubdate": "2026-10-12T16:17:08.223Z",
  "executiveSummary": "This vulnerability involves insufficient isolation of user-supplied code within Progress MarkLogic Server, categorized as an improper input validation or security boundary issue. The flaw exists within specific REST and XDBC evaluation paths, which fail to adequately sandbox or compartmentalize user-executed code from the underlying HTTP request, response, and session context.\nAn attacker who successfully leverages this vulnerability can manipulate or hijack the state of authenticated sessions, leading to unauthorized actions performed with the privileges of the victim user. The exposure primarily affects administrative or authenticated interfaces where arbitrary code execution is permitted via evaluation endpoints.\nThe scope of impact includes unauthorized data access, session tampering, and potentially complete compromise of the authenticated user's session state. The vulnerability affects MarkLogic Server 12.x versions prior to 12.1.0 and 11.x versions prior to 11.3.7. Remediation requires upgrading to the specified patched versions to restore proper isolation boundaries.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper segregation of execution contexts within the MarkLogic Server evaluation engine. Specifically, when code is submitted through designated REST or XDBC evaluation paths, the server fails to sufficiently sanitize or restrict the scope of that code relative to the broader application environment. This creates a security deficit where the executed script retains visibility or manipulation capabilities over critical artifacts such as HTTP request headers, response objects, and persistent session state data.\nThe attack flow initiates when an attacker utilizes an evaluation endpoint—intended for legitimate development or administrative tasks—to inject malicious code. Because the application fails to enforce rigid boundaries between the user-supplied logic and the server's internal state handling mechanisms, the payload executes within the context of an active session. If an authenticated user initiates or is tricked into interacting with a crafted request, the attacker’s payload can intercept, modify, or exfiltrate session tokens or manipulate response data before it is delivered to the legitimate client.\nThe vulnerability is present in the architecture responsible for mediating interaction between the XDBC (XCC/Server) protocol and REST API evaluation endpoints. These components perform code execution on behalf of the client but do not properly normalize the execution environment. By failing to strip or isolate sensitive session objects from the execution context, the server allows the injected code to elevate its operational scope beyond the intended user-level logic. This effectively bypasses the expected security controls that should limit the payload to isolated data processing tasks.\nExploitation requires the attacker to have the ability to submit code via affected paths, which often necessitates existing authentication or access to administrative interfaces. Once executed, the malicious payload functions by accessing exposed internal global objects or session variables. The post-exploitation impact includes the ability to perform actions on behalf of the victim, such as database modifications, data exfiltration, or the poisoning of session-based caches. The persistence of this issue is tied to the underlying handling of the execution context, necessitating a code-level patch to implement strict object sanitization and boundary enforcement for all evaluation paths."
}