Dynamic BPMN Override Arbitrary Script Execution in Activiti

Dear developers,

I have identified an Expression Injection vulnerability within Activiti. This flaw allows an attacker to leverage dynamic BPMN overrides to inject malicious scripts, subsequently leading to Remote Code Execution (RCE) (e.g., via the Groovy engines).

For more details, please refer to the full report here: https://github.com/qxyuan853/ExpDataset/issues/1