CVE-2025-3114
Critical
Description
Code Execution via Malicious Files: Attackers can create specially crafted files with embedded code that may execute without adequate security validation, potentially leading to system compromise. Sandbox Bypass Vulnerability: A flaw in the TERR security mechanism allows attackers to bypass sandbox restrictions, enabling the execution of untrusted code without appropriate controls.
SeverityCritical
CVSS9.4
Exploit probability—
ProductSpotfire Enterprise Runtime for R
PublishedApr 9, 2025
First seenApr 9, 2025
Weakness typeCWE-94Code injectionCWE-693CWE-693
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Spotfire Spotfire Enterprise Runtime for R | 6 ≤ v ≤ 1.4 | — |
| Spotfire Spotfire Statistics Services | 14 ≤ v ≤ 0.6, 14.1.0, 14.2.0, 14.3.0, 14.4.0, 14.4.1 | — |
| Spotfire Spotfire Analyst | 14 ≤ v ≤ 0.5, 14.1.0, 14.2.0, 14.3.0, 14.4.0, 14.4.1 | — |
| Spotfire Deployment Kit used in Spotfire Server | 14 ≤ v ≤ 0.6, 14.1.0, 14.2.0, 14.3.0, 14.4.0, 14.4.1 | — |
| Spotfire Spotfire Desktop | 14 ≤ v ≤ 4.1 | — |
| Spotfire Spotfire Enterprise Runtime for R - Server Edition | 1 ≤ v ≤ 17.6, 1.18.0, 1.19.0, 1.20.0, 1.21.0, 1.21.1 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.