CVE-2024-10094: Code Generation Vulnerability in Pega Infinity

The Improper Control of Code Generation vulnerability in Pega Infinity presents a significant risk. An attacker who successfully exploits this flaw could inject malicious code into the platform's processes, leading to remote code execution (RCE). This could allow them to gain unauthorized access to sensitive data, modify system configurations, install malware, or even take complete control of the affected Pega Infinity instance. The potential blast radius is substantial, as a compromised Pega Infinity deployment could impact numerous downstream applications and business processes that rely on it. The ability to generate arbitrary code opens the door to a wide range of attacks, including data exfiltration, denial of service, and privilege escalation.

1. Reserved2024-10-17
2. Published2024-11-20
3. EPSS updated2026-04-02

The primary mitigation for CVE-2024-10094 is to upgrade to Pega Infinity version 24.1.2 or later, which contains the fix. If immediate upgrading is not possible, consider implementing temporary workarounds. While a direct workaround is not specified, restrict access to code generation functionalities to authorized personnel only. Review and audit all code generation processes to identify any potential vulnerabilities. Implement robust input validation and sanitization to prevent malicious code from being injected. After upgrading, confirm the fix by attempting to trigger the vulnerable code generation process with a known malicious payload and verifying that it is blocked.