[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6KDM1ZXKHQJE586HTP6ZEAP":3,"skill-same:01M6KDM1ZXKHQJE586HTP6ZEAP":55},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":28,"linkOnly":29,"markdownContent":30,"markdownBody":31,"frontMatter":32,"refName":33,"commitSha":34,"skillDirectory":35,"forksCount":36,"repositoryHtmlUrl":37,"repositoryHomepageUrl":38,"ownerHtmlUrl":39,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":40,"install":41,"resources":54},"01M6KDM1ZXKHQJE586HTP6ZEAP","druid-javascript-rce",null,"Apache Druid JavaScript RCE vulnerability (CVE-2021-25646) fix via @JacksonInject hardening and constructor validation.","cxcscmu\u002FSkillLearnBench","cxcscmu","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F142838272?v=4","01M6KCQDFQWPDSN0MKZY96MSQP","01M6KCQDM7G70TKJ28NTSQC0RZ",93,"MIT","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fb1-one-shot-claude-opus-4-6\u002Ffix-security-bug\u002Fdruid-javascript-rce\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27],"javascript","rce","druid javascript rce","validation","apache","cve","hardening","vulnerability","fix","via","2026-11-10 10:12:30",false,"---\nname: druid-javascript-rce\ndescription: Apache Druid JavaScript RCE vulnerability (CVE-2021-25646) fix via @JacksonInject hardening and constructor validation.\n---\n\n# Apache Druid JavaScript RCE Vulnerability\n\n## Overview\n\nApache Druid 0.20.0 allows authenticated users to execute arbitrary server-side code through JavaScript-based features (filters, aggregators, extraction functions, etc.) even when JavaScript is disabled via `druid.javascript.enabled=false`.\n\n## Root Cause\n\nAll JavaScript-related classes use `@JacksonInject JavaScriptConfig config` to receive the server-side JavaScript configuration. Jackson's default behavior allows JSON input to override injected values via an empty key `\"\"`.\n\n## Affected Classes\n\n1. `JavaScriptDimFilter` - processing module\n2. `JavaScriptAggregatorFactory` - processing module\n3. `JavaScriptExtractionFn` - processing module\n4. `JavaScriptPostAggregator` - processing module\n5. `JavaScriptParseSpec` - core module\n6. `JavaScriptTieredBrokerSelectorStrategy` - server module (already has constructor check)\n\n## Fix Strategy\n\nFor each affected class:\n1. Change `@JacksonInject` to `@JacksonInject(useInput = OptBoolean.FALSE)`\n2. Add `Preconditions.checkState(config.isEnabled(), \"JavaScript is disabled\")` in constructors that don't already have it\n\n## Exploit Payload Example\n\n```json\n{\n  \"type\": \"index\",\n  \"spec\": {\n    \"dataSchema\": {\n      \"transformSpec\": {\n        \"filter\": {\n          \"type\": \"javascript\",\n          \"dimension\": \"dim\",\n          \"function\": \"function(x){java.lang.Runtime.getRuntime().exec('cmd')}\",\n          \"\": {\"enabled\": true}\n        }\n      }\n    }\n  }\n}\n```\n\n## Modules Requiring Rebuild\n\n- `druid-core` (JavaScriptParseSpec)\n- `druid-processing` (JavaScriptDimFilter, JavaScriptAggregatorFactory, JavaScriptExtractionFn, JavaScriptPostAggregator)\n- `druid-server` (JavaScriptTieredBrokerSelectorStrategy)\n- `druid-indexing-service` (sampler endpoint, depends on above)\n","# Apache Druid JavaScript RCE Vulnerability\n\n## Overview\n\nApache Druid 0.20.0 allows authenticated users to execute arbitrary server-side code through JavaScript-based features (filters, aggregators, extraction functions, etc.) even when JavaScript is disabled via `druid.javascript.enabled=false`.\n\n## Root Cause\n\nAll JavaScript-related classes use `@JacksonInject JavaScriptConfig config` to receive the server-side JavaScript configuration. Jackson's default behavior allows JSON input to override injected values via an empty key `\"\"`.\n\n## Affected Classes\n\n1. `JavaScriptDimFilter` - processing module\n2. `JavaScriptAggregatorFactory` - processing module\n3. `JavaScriptExtractionFn` - processing module\n4. `JavaScriptPostAggregator` - processing module\n5. `JavaScriptParseSpec` - core module\n6. `JavaScriptTieredBrokerSelectorStrategy` - server module (already has constructor check)\n\n## Fix Strategy\n\nFor each affected class:\n1. Change `@JacksonInject` to `@JacksonInject(useInput = OptBoolean.FALSE)`\n2. Add `Preconditions.checkState(config.isEnabled(), \"JavaScript is disabled\")` in constructors that don't already have it\n\n## Exploit Payload Example\n\n```json\n{\n  \"type\": \"index\",\n  \"spec\": {\n    \"dataSchema\": {\n      \"transformSpec\": {\n        \"filter\": {\n          \"type\": \"javascript\",\n          \"dimension\": \"dim\",\n          \"function\": \"function(x){java.lang.Runtime.getRuntime().exec('cmd')}\",\n          \"\": {\"enabled\": true}\n        }\n      }\n    }\n  }\n}\n```\n\n## Modules Requiring Rebuild\n\n- `druid-core` (JavaScriptParseSpec)\n- `druid-processing` (JavaScriptDimFilter, JavaScriptAggregatorFactory, JavaScriptExtractionFn, JavaScriptPostAggregator)\n- `druid-server` (JavaScriptTieredBrokerSelectorStrategy)\n- `druid-indexing-service` (sampler endpoint, depends on above)\n",{"name":5,"description":7},"main","726e1f79b96b0cb3d729d0e55a1c847e0b5353ae","skills\u002Fb1-one-shot-claude-opus-4-6\u002Ffix-security-bug\u002Fdruid-javascript-rce",7,"https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench","https:\u002F\u002Fcxcscmu.github.io\u002FSkillLearnBench","https:\u002F\u002Fgithub.com\u002Fcxcscmu","2026-10-02 22:55:36",{"source":8,"skillName":5,"commands":42,"prompt":52,"zipAvailable":53},[43,46,49],{"tool":44,"command":45},"npx","npx skills add cxcscmu\u002FSkillLearnBench --skill druid-javascript-rce",{"tool":47,"command":48},"bunx","bunx skills add cxcscmu\u002FSkillLearnBench --skill druid-javascript-rce",{"tool":50,"command":51},"pnpm","pnpm dlx skills add cxcscmu\u002FSkillLearnBench --skill druid-javascript-rce","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fb1-one-shot-claude-opus-4-6\u002Ffix-security-bug\u002Fdruid-javascript-rce\u002FSKILL.md",true,[],[56,74,99,117,137,149],{"skillNo":57,"name":58,"nameZh":6,"description":59,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":60,"categories":61,"keywords":67,"publishedAt":28},"01M6KM5KH175P5ABP5JMX2SBDQ","object_counter","Count occurrences of an object in the image using computer vision algorithm.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Fvideo-object-counting\u002Fobject_counter\u002FSKILL.md",[62],{"categoryNo":63,"categoryName":64,"taxonomyType":65,"taxonomyTypeDesc":66},"01JBSEEDCAT000000000000016","图像与多媒体","SCENARIO","使用场景",[68,69,70,71,72,73],"object counter","object","vision","computer","Computer Vision","image",{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":78,"categories":79,"keywords":83,"publishedAt":28},"01M6KM51TMVXG79MMPCS6Y8G86","travel-planning-workflow","Invoke this skill when performing travel planning. It defines a structured workflow for generating itineraries. Following this workflow is essential to ensure the final plan satisfies user requirements.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftravel-planning\u002Ftravel-planning-workflow\u002FSKILL.md",[80],{"categoryNo":81,"categoryName":82,"taxonomyType":65,"taxonomyTypeDesc":66},"01JBSEEDCAT000000000000023","Skill与智能体开发",[84,85,86,87,88,89,90,91,92,93,94,95,96,97,98],"workflow","planning","planning workflow","travel","travel planning","travel planning workflow","structured","performing","plan","for","user","it","requirements","essential","itineraries",{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":28},"01M6KM4DY820XHS9YTSK5QP5HD","bundled-dataset-search-tool","invoke this skill when you need to perform database search for travel planning. This skill provides some useful pre-packaged tools to look up accommodations, attractions, cities, driving distance, flights, and restaurants from the bundled dataset.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftravel-planning\u002Fbundled-dataset-search-tool\u002FSKILL.md",[],[106,107,108,109,110,111,112,87,113,114,88,115,93,116,85],"search","tool","dataset","bundled dataset search tool","restaurants","Tools","up","look","flights","you","database",{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":123,"publishedAt":28},"01M6KM465BB9PQ0B548HQSVAWZ","glm-output","Output-processing guidance for GLM tasks. Especially useful after glm-basics and glm-calibration when you need verifier-matching metrics from output.nc and a final \u002Froot\u002Fmetrics.json.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-output\u002FSKILL.md",[],[124,125,126,93,127,128,129,130,131,132,133,134,115,135,136],"glm output","output","glm","tasks","metrics","json","basics","guidance","matching","verifier","processing","root","calibration",{"skillNo":138,"name":139,"nameZh":6,"description":140,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":141,"categories":142,"keywords":144,"publishedAt":28},"01M6KM40KY3QWDW5W97S39R2BC","glm-calibration","Calibration guidance for GLM tasks. Often most effective after glm-basics has clarified the setup; glm-output is the companion skill for exact final metric computation.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-calibration\u002FSKILL.md",[143],{"categoryNo":81,"categoryName":82,"taxonomyType":65,"taxonomyTypeDesc":66},[145,136,126,125,131,130,127,146,147,93,148],"glm calibration","setup","companion","metric",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":155,"publishedAt":28},"01M6KM3VHHVSGMGHJQB3PPT6YG","glm-basics","A good starting point for GLM calibration tasks. Use to inspect glm3.nml, confirm how GLM runs, and identify the relevant files before moving on to calibration and output evaluation.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-basics\u002FSKILL.md",[],[156,126,130,157,145,136,93,125,158,159,160,161,162,163,127],"glm basics","inspect","relevant","files","good","use","how","Evaluation"]