JimuReport versions up to 2.3.4 are vulnerable to remote code execution because the /jmreport/executeSelectApi endpoint directly passes user-supplied input to the Aviator expression engine without sufficient validation. This improper handling enables attackers to craft malicious expressions that the engine executes, leading to arbitrary code execution on the server hosting JimuReport.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code remotely on the affected system, potentially leading to full system compromise depending on the privileges of the JimuReport process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing the /jmreport/executeSelectApi endpoint to untrusted users or networks and consider implementing input validation or filtering at the application or network level to mitigate risk.