This vulnerability sounds similar to the issue I described here: https://crashcoherency.net/posts/perils_of_source_based_sandboxing https://crashcoherency.net/p

This vulnerability sounds similar to the issue I described here: https://crashcoherency.net/posts/perils_of_source_based_sandboxing https://crashcoherency.net/posts/perils_of_source_based_sand... tl;dr: If you're doing sandboxing by blacklisting specific strings in your input, you're doing it wrong. Java actually has good sandboxing capabilities. Use them!