Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Rhino JavaScript engine could allow unauthorized code execution
published 3 months ago
Summary
The Rhino JavaScript engine used in several Mozilla components can be tricked into running malicious code. This could let an attacker take control of affected applications. Updating to the latest Rhino version provided by TuxCare resolves the issue.
What to do
- Update mozilla org.mozilla:rhino to version 1.7.15-tuxcare.1.
- Update mozilla org.mozilla:rhino-engine to version 1.7.15-tuxcare.1.
- Update mozilla org.mozilla:rhino-runtime to version 1.7.15-tuxcare.1.
- Update org.mozilla:rhino to version 1.7.15-tuxcare.1.
- Update org.mozilla:rhino-engine to version 1.7.15-tuxcare.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Maven | mozilla | org.mozilla:rhino |
>= 1.7.15, < 1.7.15-tuxcare.1 Fix: upgrade to 1.7.15-tuxcare.1
|
| TuxCare:Maven | mozilla | org.mozilla:rhino-engine |
>= 1.7.15, < 1.7.15-tuxcare.1 Fix: upgrade to 1.7.15-tuxcare.1
|
| TuxCare:Maven | mozilla | org.mozilla:rhino-runtime |
>= 1.7.15, < 1.7.15-tuxcare.1 Fix: upgrade to 1.7.15-tuxcare.1
|
| TuxCare:Maven | – | org.mozilla:rhino |
>= 1.7.15, < 1.7.15-tuxcare.1 Fix: upgrade to 1.7.15-tuxcare.1
|
| TuxCare:Maven | – | org.mozilla:rhino-engine |
>= 1.7.15, < 1.7.15-tuxcare.1 Fix: upgrade to 1.7.15-tuxcare.1
|
Original advisory text
TuxCare security update for org.mozilla:rhino (1 CVE)
TuxCare rebuilt org.mozilla:rhino to address 1 CVE. Fixed in 1.7.15-tuxcare.1.
Timeline
Published4 Aug 2026
Updated2 Nov 2026
First seen15 Oct 2026
Sources
CLSA-2026-1771546195 · OSV
Track software like this
Free during beta