CVE-2018-10054: H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CRE...

Security readout for executives and security teams

This issue is dangerous when H2 is reachable by untrusted users. H2 1.4.197 permits Java code execution through CREATE ALIAS, and Datomic issued an update for deployments that embedded it. The H2 vendor notes H2 assumes a secure environment, so exposure depends heavily on how products expose database access. Most likely exposed systems are products embedding H2 1.4.197, Datomic versions before 0.9.5697, or environments where H2 SQL or console access is reachable by untrusted users. Prioritize systems where H2 is remotely reachable or embedded in business applications. The business risk is highest when database administration is exposed beyond trusted operators. Mitigation focus: Upgrade Datomic to 0.9.5697 or later where applicable.; Inventory software that embeds H2 and check vendor advisories.; Do not expose H2 console or SQL access to untrusted networks..

Prepared

Jun 7, 2026, 14:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.