GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the Saxon XSLT processor used to render formatters is configured without secure processing (`FEATURE_SECURE_PROCESSING`) and without disabling Java extension functions (`ALLOW_EXTERNAL_FUNCTIONS`). Any stylesheet loaded by GeoNetwork can therefore invoke `java.lang.Runtime.exec()` or `java.lang.ProcessBuilder` directly, achieving arbitrary command execution as the GeoNetwork process user. A user with sufficient privileges to upload a formatter can deliver a `.xsl` file containing Java extension call that execute arbitrary OS commands with the privileges of the GeoNetwork process. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.

GeoNetwork, a catalog application for managing spatially referenced resources, contains a critical vulnerability in its Saxon XSLT processor prior to versions 4.4.12 and 4.2.17. The processor is configured without secure processing (FEATURE_SECURE_PROCESSING) and without disabling Java extension functions (ALLOW_EXTERNAL_FUNCTIONS), allowing any loaded stylesheet to invoke java.lang.Runtime.exec() or java.lang.ProcessBuilder directly. A privileged user capable of uploading a formatter can deliver a malicious .xsl file containing Java extension calls that execute arbitrary OS commands with the privileges of the GeoNetwork process. This constitutes a Remote Code Execution (RCE) vulnerability exploitable by authenticated users with formatter upload permissions. The vulnerability has been patched in GeoNetwork versions 4.4.12 and 4.2.17. Users are strongly advised to upgrade to the patched versions immediately to mitigate the risk of arbitrary command execution on affected systems.