CVE-2025-0982 is a critical sandbox escape (CVSS 10.0) in the JavaScript Task feature of Google Cloud Application Integration, where the Rhino engine could run crafted code outside its sandbox. Google ended Rhino support on January 24, 2025, and the record says no further fix actions are needed.
What's affected
The affected component is the JavaScript Task in Google Cloud Application Integration, a managed Google service. There is no package version to look up, because Google runs the service. The record describes the problem as a sandbox escape that allows an actor to execute arbitrary unsandboxed code through crafted JavaScript run by the Rhino engine.
Google's release note of January 23, 2025 is titled "Deprecation of Rhino engine for JavaScript Task". It says that effective January 24, 2025, Application Integration no longer supports Rhino as the JavaScript execution engine. It also says existing published JavaScript tasks can keep using Rhino or be migrated to V8 manually, while new JavaScript tasks use only V8. The note links the change to CVE-2025-0982. It does not describe the weakness itself.
The weakness class is CWE-829 (inclusion of functionality from an untrusted control sphere). The record scores it 10.0 CRITICAL. The record's vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
How to check if you're exposed
There is nothing to patch on your side, but you can still see whether you rely on the old engine. The steps come from Google's release note, so check the live Application Integration documentation for current wording.
- List the integrations in your Google Cloud project that contain a JavaScript Task.
- For each one, confirm which execution engine it uses. Existing published tasks may still be on Rhino, according to the note.
- Note who can edit those integrations, because a JavaScript Task runs code that an editor writes.
What to do now
- Read Google's release note for the January 2025 deprecation and the current Application Integration documentation.
- Migrate existing JavaScript Tasks to the V8 engine, which the note says you can do manually.
- Review who has permission to create or edit integrations that contain JavaScript Tasks, and remove access that people do not need.
- Check audit logs for unexpected changes to JavaScript Tasks around and before the deprecation date.
- Keep an inventory of the managed services your data flows through, so the next advisory like this one takes minutes to answer. The free in-browser dependency scan and the Gold directory show which known issues sit in the components you ship.
Why it matters
Running user-supplied script inside a host process is hard to get right. A sandbox is meant to limit what the script can touch, and when it fails, the script runs with the rights of the surrounding service. That is what "unsandboxed code" means here.
This record is a good example of a vulnerability that the vendor handled at the platform level. The CVE exists so customers can see that the issue was real and how it was resolved. The record is not marked as exploited in the wild by CISA, and I found no statement of exploitation in the release note. The reasonable follow-up is housekeeping: confirm you are on V8 and tighten who can write code in your integrations.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to patch anything for CVE-2025-0982?
The record says no further fix actions are needed, because Google stopped supporting Rhino on January 24, 2025. Google's note also says existing published tasks can stay on Rhino or move to V8 manually, so review your own tasks.
Is CVE-2025-0982 exploited in the wild?
The record is not on the CISA Known Exploited Vulnerabilities list, and Google's release note does not say so. Do not assume either way, and check your logs.
Sources
- Google Cloud Application Integration release notes
- NVD record for CVE-2025-0982
Last reviewed: 19 October 2026.
