Threats affecting pkg:github/conductor

Orkes Conductor versions 3.21.21 up to but not including 3.30.2 contain a critical unauthenticated remote code execution vulnerability. This flaw allows remote attackers to execute arbitrary operating system commands by submitting malicious inline workflow definitions with JavaScript or Python expressions to the workflow API endpoint before authentication. The vulnerability arises from unsandboxed GraalVM evaluators configured with permissive HostAccess settings, enabling invocation of system commands via Java reflection or subprocess calls. A fix is available in version 3.30.2.