Spotfire Code Execution Vulnerability

Description

Code Execution via Malicious Files: Attackers can create specially crafted files with embedded code that may execute without adequate security validation, potentially leading to system compromise. Sandbox Bypass Vulnerability: A flaw in the TERR security mechanism allows attackers to bypass sandbox restrictions, enabling the execution of untrusted code without appropriate controls.

Scores

EPSS (exploitation in 30 days)

0.61% · top 51% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.4.

Weakness

• CWE-94 Improper Control of Generation of Code ('Code Injection') (opens in a new tab)All about CWE-94 and its CVEs
• CWE-693 Protection Mechanism Failure (opens in a new tab)All about CWE-693 and its CVEs

Affected products

• Spotfire · Spotfire Enterprise Runtime for R

  • affected 6 – ≤ 1.4

• Spotfire · Spotfire Statistics Services

  • affected 14 – ≤ 0.6
  • affected 14.1.0
  • affected 14.2.0
  • affected 14.3.0
  • affected 14.4.0
  • affected 14.4.1

• Spotfire · Spotfire Analyst

  • affected 14 – ≤ 0.5
  • affected 14.1.0
  • affected 14.2.0
  • affected 14.3.0
  • affected 14.4.0
  • affected 14.4.1

• Spotfire · Deployment Kit used in Spotfire Server

  • affected 14 – ≤ 0.6
  • affected 14.1.0
  • affected 14.2.0
  • affected 14.3.0
  • affected 14.4.0
  • affected 14.4.1

• Spotfire · Spotfire Desktop

  • affected 14 – ≤ 4.1

• Spotfire · Spotfire for AWS Marketplace

  • unknown 14 – ≤ 4.1

• Spotfire · Spotfire Enterprise Runtime for R - Server Edition

  • affected 1 – ≤ 17.6
  • affected 1.18.0
  • affected 1.19.0
  • affected 1.20.0
  • affected 1.21.0
  • affected 1.21.1

References (1)

• https://community.spotfire.com/articles/spotfire/spotfire-security-advisory-april-08-2025-spotfire-cve-2025-3114-r3484/ (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-3114](https://trackcve.app/badge/CVE-2025-3114.svg)](https://trackcve.app/cve/CVE-2025-3114)

Record last updated 15 Apr 2025, 20:29 UTC.