CVE-2018-10054: cognitect datomic Improper Input Validation
Vulnerability summary
CVE-2018-10054 is a high (CVSS 8.8) Improper Input Validation vulnerability in cognitect datomic. EPSS estimates a 33.74% chance of exploitation in the next 30 days, higher than 98.3% of scored vulnerabilities. 2 public exploits are recorded.
Weaponized exploit (exploit-database, 09-04-2018)
Source freshness unavailable
How is this decided?Timeline
- 11-04-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code. NOTE: the vendor's position is "h2 is not designed to be run outside of a secure environment."
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · MavenEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
33.74%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
No change 0.00 pp
From 33.74% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
2 foundH2 Database - 'Alias' Arbitrary Code Execution
Maturity: weaponized
H2 Web Interface Create Alias RCE
exploit/linux/http/h2_webinterface_rce
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Cognitect1 product
- datomic< 0.9.5697
Com.datomic1 product
- datomic-free< 0.9.5697
H2database1 product
- h21.4.197
3 vendors · 3 products
