Individual skill

evo-druid-cve-patch

Patches Apache Druid 0.20.0 for CVE-2021-25646 - a JavaScript injection vulnerability where empty-string keys in JSON payloads can override server-side JavaScriptConfig to enable arbitrary code exe...

tasks-evolved/fix-druid-loophole-cve/environment/skills/evo-druid-cve-patch/SKILL.md

Read pinned source

Source commit 84ca182da055fafb6453dcec4a6defdbbfd987c1

What was checked

Matches the observed repository HEAD: Yes
Scanner rules are current: Yes
Repository scan complete: No
Skill scan complete: No
Observed behavior: Local scripts
Last checked: Nov 6, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings): 97
Repository last updated: Sep 10, 2026
License: Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

agent-skills Repository topic
ai-agents Repository topic
llm-agents Repository topic
open-world Repository topic
self-evolving-agents Repository topic
security Derived category

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files

SKILL.mdcore · 3,199 bytes
SKILL.mdcore · 3,199 bytes
SKILL.mdcore · 3,199 bytes
SKILL.mdcore · 3,199 bytes
scripts/patch_druid.pyruns · 7,857 bytes

Read excerpt


# Skill: evo-druid-cve-patch

## Purpose
Patches Apache Druid 0.20.0 for CVE-2021-25646 - a JavaScript injection vulnerability where
empty-string keys in JSON payloads can override server-side JavaScriptConfig to enable
arbitrary code execution.

## Vulnerability Summary
- **CVE**: CVE-2021-25646
- **Affected**: Apache Druid <= 0.20.0
- **Mechanism**: Empty key `""` in JSON overrides `@JacksonInject JavaScriptConfig` parameter
- **Impact**: Authenticated RCE via JavaScript filters/aggregators/extraction functions

## Patch Strategy (Two-Layer Defense)