CVE-2025-11919: Wolfram Cloud Vulnerability Exposes Users to Privilege Escalation and Remote Code Execution

CVE-2025-11919 concerns Wolfram Cloud version 14.2, which could allow attackers to achieve privilege escalation, information exfiltration and remote code execution (RCE) within multi-tenant cloud environments. According to CERT Coordination Center (CERT/CC), the flaw stems from improper handling of temporary directories in the platform’s Java Virtual Machine, with a newly discovered race condition allowing attackers to poison the classpath via the shared /tmp/ directory during JVM initialization.

CERT/CC describes the consequence as attackers potentially executing arbitrary code with the victim’s process privileges in multi-tenant contexts. CERT/CC credited Peter Roberge of Pointer Cybersecurity for discovering and reporting the flaw. To address the issue, CERT/CC recommends updating to Wolfram Cloud version 14.2.1, which includes improved handling of temporary directories and enhanced isolation for JVM instances.