Introduction HSQLDB (HyperSQL DataBase) is the leading SQL relational database system written in Java. It offers a small, fast multithreaded and transactional database engine with in-memory and disk-based tables and supports embedded and server modes. It includes a powerful command line SQL tool and simple GUI query tools. Reference: https://hsqldb.org/ What is CVE-2022-41853? A potential remote code execution vulnerability was detected in java.sql.Statement and java.sql.PreparedStatement, in the parsing procedure for binary and text format data. By default, SQL statements can be used to call any static method from any Java class in the class path. HSQLDB (HyperSQL DataBase) allowed direct use of methods, e.g. call org.hsqldb.clazz.meth(). Affected versions: All versions <= 2.7.0 Impact of CVE-2022-41853 Applications that are using java.sql.Statement or java.sql.PreparedStatement in HSQLDB with untrusted input may be vulnerable to a remote code execution attack, having a solid critical impact on the affected applications and their underlying systems. Remediation and Mitigation If HSQLDB is used to process queries with user input, the hsqldb.method_class_names property must be defined with a list of class names or wildcards in case a static Java method is used as a target of an HSQLDB routine. Without a property definition, the use of Java static methods, except those in java.lang.Math, should not be allowed. Developers can prevent the issue by defining the system property. For example: System.setProperty("hsqldb.method_class_names", "abc") or  java -Dhsqldb.method_class_names="abc" The issue is already fixed upstream and will be available in the next release. From version 2.7.1. the property hsqldb.method_class_names must be defined with a list of class names or wild cards if any Java static method is used as an HSQLDB routine target. References https://hsqldb.org/ http://hsqldb.org/doc/2.0/guide/sqlroutines-chapt.html#src_jrt_access_control https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50212#c7 https://www.code-intelligence.com/blog/potential-remote-code-execution-in-hsqldb