# Vulnerability with springshell, is SonarQube impacted

**URL:** <https://community.sonarsource.com/t/vulnerability-with-springshell-is-sonarqube-impacted/60833>\
**Category:** SonarQube Server / Community Build\
**Created:** [March 31, 2022, 6:58am UTC](https://community.sonarsource.com/t/vulnerability-with-springshell-is-sonarqube-impacted/60833 "2022-03-31T06:58:01Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![SebG](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/sebg/32/5563_2.png) [@SebG](https://community.sonarsource.com/u/SebG)\
**Post date:** [March 31, 2022, 6:58am UTC](https://community.sonarsource.com/t/vulnerability-with-springshell-is-sonarqube-impacted/60833/1 "2022-03-31T06:58:01Z")

</div>

Good morning,

Using Sonarqube 8.9.6, I’m wondering if it could be impacted by the vulnerability raised yesterday by Sonatype:[New Spring Framework RCE&nbsp; Vulnerability Confirmed - What to do?](https://blog.sonatype.com/new-0-day-spring-framework-vulnerability-confirmed)

It impacts java applications using spring-code fmk and JDK 9 and above.

thanks for your feedback  
Sebastien.

---

<div class="post-metadata">

**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\
**Post date:** [March 31, 2022, 9:14am UTC](https://community.sonarsource.com/t/vulnerability-with-springshell-is-sonarqube-impacted/60833/2 "2022-03-31T09:14:07Z")

</div>

Hey there.

SonarQube is not affected.

---

<div class="post-metadata">

**Author:** ![SebG](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/sebg/32/5563_2.png) [@SebG](https://community.sonarsource.com/u/SebG)\
**Post date:** [March 31, 2022, 9:27am UTC](https://community.sonarsource.com/t/vulnerability-with-springshell-is-sonarqube-impacted/60833/3 "2022-03-31T09:27:19Z")

</div>

Thank you for your answer.