CVE-2024-0738 is a medium severity flaw in mldong 1.0, scored 6.3 by NVD. No fixed version is confirmed in the sources I could check, so limit who can reach it, watch for a vendor release, and plan an upgrade or replacement.
What's affected
The record lists mldong 1.0 as affected. The record says the ExpressionEngine function in com/mldong/modules/wf/engine/model/DecisionModel.java leads to code injection and that the attack may be initiated remotely. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. The weakness is CWE-94.
The record's description is short and does not name a fixed release. The linked pages are public write-ups of the issue, not a vendor patch notice.
How to check if you're exposed
Check your Java applications for the mldong project and its workflow module, using your build files and deployed artifacts. Version 1.0 is named. If your application embeds the module as a library, a dependency scan will show it.
If the product reached you inside another package, run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests to see whether it appears. For standalone software, the inventory is the check: find where it is installed, which version it is, and whether the service is reachable from outside the machine.
What to do now
- Find every installation of the product and note its version.
- Check the vendor site and project repository for a newer release, and read its notes before upgrading. Do not assume a later version is fixed without a statement that says so.
- Restrict network access to the service with firewall rules so only trusted hosts can reach it.
- Watch logs for repeated odd requests or unexpected crashes aimed at the affected component.
- If the software looks unmaintained, plan to replace it, and record the risk decision in the meantime.
Why it matters
Code injection means input is evaluated as code or as an expression by the application. In a workflow engine, decisions are often written as expressions, so the engine has to evaluate text at run time. If that text can come from a user, it needs to be restricted to a safe subset or sandboxed. The record tags CWE-94.
The score is medium because the record's vector requires a low privilege account and rates impact low. Remote code execution flaws in Java workflow code can be worse than scored, since the process runs with the application's rights. An open source project with a small user base may be slow to ship a fix, so segment the host and limit who can submit workflow definitions.
The record notes that an exploit has been disclosed publicly. That is not the same as confirmed attacks, and the record does not flag this CVE in the CISA Known Exploited Vulnerabilities list. Public detail still lowers the effort for someone to try it, which is a reason to reduce exposure early.
Quick check
Is the project maintained?
Check its repository. The record gives no fixed release.
What kind of account is needed?
The vector says a low privilege account.
Sources
Last reviewed: 19 October 2026.
