[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6KH3Z0HC7RYPE7KB1MNE523":3,"skill-same:01M6KH3Z0HC7RYPE7KB1MNE523":65},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":43,"commitSha":44,"skillDirectory":45,"forksCount":46,"repositoryHtmlUrl":47,"repositoryHomepageUrl":48,"ownerHtmlUrl":49,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":50,"install":51,"resources":64},"01M6KH3Z0HC7RYPE7KB1MNE523","apache-druid-javascript-rce-vulnerability-analysis",null,"Understanding the CVE in Apache Druid 0.20.0 where authenticated attackers can execute arbitrary code via JavaScript payloads. The vulnerability exploits @JacksonInject with empty key \"\" to override JavaScriptConfig and enable JavaScript execution even when disabled. Use this skill to understand the attack vector and plan the fix.","cxcscmu\u002FSkillLearnBench","cxcscmu","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F142838272?v=4","01M6KCQDFQWPDSN0MKZY96MSQP","01M6KCQDM7G70TKJ28NTSQC0RZ",93,"MIT","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fb3-teacher-feedback-claude-opus-4-6\u002Ffix-security-bug\u002Frun3_apache-druid-javascript-rce-vulnerability-analysis\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"apache druid javascript rce vulnerability analysis","apache","druid javascript rce","rce","analysis","vulnerability","javascript","execute","can","with","understand","via","use","payloads","fix","plan","execution","cve","vector","code","2026-11-10 10:12:30",false,"---\nname: apache-druid-javascript-rce-vulnerability-analysis\ndescription: Understanding the CVE in Apache Druid 0.20.0 where authenticated attackers can execute arbitrary code via JavaScript payloads. The vulnerability exploits @JacksonInject with empty key \"\" to override JavaScriptConfig and enable JavaScript execution even when disabled. Use this skill to understand the attack vector and plan the fix.\n---\n\n## Vulnerability Overview\n\nApache Druid 0.20.0 has a Remote Code Execution (RCE) vulnerability through JavaScript filters, transforms, and other JavaScript-enabled features.\n\n### Attack Vector\n\nThe exploit sends JSON payloads with a `\"\"` (empty string) key that maps to the `JavaScriptConfig` parameter in filter\u002Faggregator constructors. Because Jackson's `@JacksonInject` annotation defaults to allowing input values to override injected values, an attacker can supply a `JavaScriptConfig` with `enabled: true`, bypassing the server's security configuration.\n\n### Affected Components\n\nJavaScript-enabled features in Druid that accept `JavaScriptConfig` via `@JacksonInject`:\n\n1. **JavaScriptFilter** — `processing\u002Fsrc\u002Fmain\u002Fjava\u002Forg\u002Fapache\u002Fdruid\u002Fquery\u002Ffilter\u002FJavaScriptDimFilter.java`\n2. **JavaScriptAggregatorFactory** — `processing\u002Fsrc\u002Fmain\u002Fjava\u002Forg\u002Fapache\u002Fdruid\u002Fquery\u002Faggregation\u002FJavaScriptAggregatorFactory.java`\n3. **JavaScriptExtractionFn** — `processing\u002Fsrc\u002Fmain\u002Fjava\u002Forg\u002Fapache\u002Fdruid\u002Fquery\u002Fextraction\u002FJavaScriptExtractionFn.java`\n4. **JavaScriptParseSpec** — `processing\u002Fsrc\u002Fmain\u002Fjava\u002Forg\u002Fapache\u002Fdruid\u002Fdata\u002Finput\u002Fimpl\u002FJavaScriptParseSpec.java`\n5. **JavaScriptPostAggregator** — `processing\u002Fsrc\u002Fmain\u002Fjava\u002Forg\u002Fapache\u002Fdruid\u002Fquery\u002Faggregation\u002Fpost\u002FJavaScriptPostAggregator.java`\n\n### Root Cause\n\nThe `@JacksonInject` annotation without `useInput = OptBoolean.FALSE` allows deserialized JSON input to override the server-side injected `JavaScriptConfig`. The empty key `\"\"` in JSON is used because `@JacksonInject` without a value attribute uses empty string as the injection key.\n\n### Fix Strategy\n\nChange all `@JacksonInject` annotations on `JavaScriptConfig` parameters to include `useInput = OptBoolean.FALSE`, which tells Jackson to never use input JSON to fill this parameter — only the injected server-side value will be used.","## Vulnerability Overview\n\nApache Druid 0.20.0 has a Remote Code Execution (RCE) vulnerability through JavaScript filters, transforms, and other JavaScript-enabled features.\n\n### Attack Vector\n\nThe exploit sends JSON payloads with a `\"\"` (empty string) key that maps to the `JavaScriptConfig` parameter in filter\u002Faggregator constructors. Because Jackson's `@JacksonInject` annotation defaults to allowing input values to override injected values, an attacker can supply a `JavaScriptConfig` with `enabled: true`, bypassing the server's security configuration.\n\n### Affected Components\n\nJavaScript-enabled features in Druid that accept `JavaScriptConfig` via `@JacksonInject`:\n\n1. **JavaScriptFilter** — `processing\u002Fsrc\u002Fmain\u002Fjava\u002Forg\u002Fapache\u002Fdruid\u002Fquery\u002Ffilter\u002FJavaScriptDimFilter.java`\n2. **JavaScriptAggregatorFactory** — `processing\u002Fsrc\u002Fmain\u002Fjava\u002Forg\u002Fapache\u002Fdruid\u002Fquery\u002Faggregation\u002FJavaScriptAggregatorFactory.java`\n3. **JavaScriptExtractionFn** — `processing\u002Fsrc\u002Fmain\u002Fjava\u002Forg\u002Fapache\u002Fdruid\u002Fquery\u002Fextraction\u002FJavaScriptExtractionFn.java`\n4. **JavaScriptParseSpec** — `processing\u002Fsrc\u002Fmain\u002Fjava\u002Forg\u002Fapache\u002Fdruid\u002Fdata\u002Finput\u002Fimpl\u002FJavaScriptParseSpec.java`\n5. **JavaScriptPostAggregator** — `processing\u002Fsrc\u002Fmain\u002Fjava\u002Forg\u002Fapache\u002Fdruid\u002Fquery\u002Faggregation\u002Fpost\u002FJavaScriptPostAggregator.java`\n\n### Root Cause\n\nThe `@JacksonInject` annotation without `useInput = OptBoolean.FALSE` allows deserialized JSON input to override the server-side injected `JavaScriptConfig`. The empty key `\"\"` in JSON is used because `@JacksonInject` without a value attribute uses empty string as the injection key.\n\n### Fix Strategy\n\nChange all `@JacksonInject` annotations on `JavaScriptConfig` parameters to include `useInput = OptBoolean.FALSE`, which tells Jackson to never use input JSON to fill this parameter — only the injected server-side value will be used.",{"name":5,"description":7},"main","726e1f79b96b0cb3d729d0e55a1c847e0b5353ae","skills\u002Fb3-teacher-feedback-claude-opus-4-6\u002Ffix-security-bug\u002Frun3_apache-druid-javascript-rce-vulnerability-analysis",8,"https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench","https:\u002F\u002Fcxcscmu.github.io\u002FSkillLearnBench","https:\u002F\u002Fgithub.com\u002Fcxcscmu","2026-10-02 22:55:36",{"source":8,"skillName":5,"commands":52,"prompt":62,"zipAvailable":63},[53,56,59],{"tool":54,"command":55},"npx","npx skills add cxcscmu\u002FSkillLearnBench --skill apache-druid-javascript-rce-vulnerability-analysis",{"tool":57,"command":58},"bunx","bunx skills add cxcscmu\u002FSkillLearnBench --skill apache-druid-javascript-rce-vulnerability-analysis",{"tool":60,"command":61},"pnpm","pnpm dlx skills add cxcscmu\u002FSkillLearnBench --skill apache-druid-javascript-rce-vulnerability-analysis","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fb3-teacher-feedback-claude-opus-4-6\u002Ffix-security-bug\u002Frun3_apache-druid-javascript-rce-vulnerability-analysis\u002FSKILL.md",true,[],[66,84,108,126,146,158],{"skillNo":67,"name":68,"nameZh":6,"description":69,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":70,"categories":71,"keywords":77,"publishedAt":38},"01M6KM5KH175P5ABP5JMX2SBDQ","object_counter","Count occurrences of an object in the image using computer vision algorithm.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Fvideo-object-counting\u002Fobject_counter\u002FSKILL.md",[72],{"categoryNo":73,"categoryName":74,"taxonomyType":75,"taxonomyTypeDesc":76},"01JBSEEDCAT000000000000016","图像与多媒体","SCENARIO","使用场景",[78,79,80,81,82,83],"object counter","object","vision","computer","Computer Vision","image",{"skillNo":85,"name":86,"nameZh":6,"description":87,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":88,"categories":89,"keywords":93,"publishedAt":38},"01M6KM51TMVXG79MMPCS6Y8G86","travel-planning-workflow","Invoke this skill when performing travel planning. It defines a structured workflow for generating itineraries. Following this workflow is essential to ensure the final plan satisfies user requirements.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftravel-planning\u002Ftravel-planning-workflow\u002FSKILL.md",[90],{"categoryNo":91,"categoryName":92,"taxonomyType":75,"taxonomyTypeDesc":76},"01JBSEEDCAT000000000000023","Skill与智能体开发",[94,95,96,97,98,99,100,101,33,102,103,104,105,106,107],"workflow","planning","planning workflow","travel","travel planning","travel planning workflow","structured","performing","for","user","it","requirements","essential","itineraries",{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":114,"publishedAt":38},"01M6KM4DY820XHS9YTSK5QP5HD","bundled-dataset-search-tool","invoke this skill when you need to perform database search for travel planning. This skill provides some useful pre-packaged tools to look up accommodations, attractions, cities, driving distance, flights, and restaurants from the bundled dataset.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftravel-planning\u002Fbundled-dataset-search-tool\u002FSKILL.md",[],[115,116,117,118,119,120,121,97,122,123,98,124,102,125,95],"search","tool","dataset","bundled dataset search tool","restaurants","Tools","up","look","flights","you","database",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":132,"publishedAt":38},"01M6KM465BB9PQ0B548HQSVAWZ","glm-output","Output-processing guidance for GLM tasks. Especially useful after glm-basics and glm-calibration when you need verifier-matching metrics from output.nc and a final \u002Froot\u002Fmetrics.json.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-output\u002FSKILL.md",[],[133,134,135,102,136,137,138,139,140,141,142,143,124,144,145],"glm output","output","glm","tasks","metrics","json","basics","guidance","matching","verifier","processing","root","calibration",{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":153,"publishedAt":38},"01M6KM40KY3QWDW5W97S39R2BC","glm-calibration","Calibration guidance for GLM tasks. Often most effective after glm-basics has clarified the setup; glm-output is the companion skill for exact final metric computation.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-calibration\u002FSKILL.md",[152],{"categoryNo":91,"categoryName":92,"taxonomyType":75,"taxonomyTypeDesc":76},[154,145,135,134,140,139,136,155,156,102,157],"glm calibration","setup","companion","metric",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":164,"publishedAt":38},"01M6KM3VHHVSGMGHJQB3PPT6YG","glm-basics","A good starting point for GLM calibration tasks. Use to inspect glm3.nml, confirm how GLM runs, and identify the relevant files before moving on to calibration and output evaluation.","https:\u002F\u002Fgithub.com\u002Fcxcscmu\u002FSkillLearnBench\u002Fblob\u002Fmain\u002Fskills\u002Fhuman_authored\u002Ftemperature-simulation\u002Fglm-basics\u002FSKILL.md",[],[165,135,139,166,154,145,102,134,167,168,169,30,170,171,136],"glm basics","inspect","relevant","files","good","how","Evaluation"]