CVE-2025-59302

*** Pendiente de traducción *** In Apache CloudStack improper control of generation of code (&amp;#39;Code Injection&amp;#39;) vulnerability is found in the following APIs which are accessible only to admins.<br /> <br /> * quotaTariffCreate<br /> * quotaTariffUpdate<br /> * createSecondaryStorageSelector<br /> * updateSecondaryStorageSelector<br /> * updateHost<br /> * updateStorage<br /> <br /> <br /> This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix.<br /> <br /> The fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk.