Known Issues

Unauthenticated JRXML expression injection allows remote code execution

An unauthenticated remote code execution (RCE) vulnerability exists through the JasperReportsMenu plugin, affecting ALL versions of Joget. The flaw stems from an anonymously accessible endpoint that processes caller-controlled userview JSON without adequate restriction, allowing attackers to supply malicious JRXML report markup. See Security Advisories for mitigation steps.

Activity remains stuck when a workflow variable is not declared in Process Builder in Joget DX 9.1.0.1

When a workflow variable is mapped from a form field but is not declared in the Process Builder, the activity remains in the open.running state after form submission. 

At runtime, the UI indicates that the activity has been completed successfully. However, the workflow does not proceed, and the following error is logged:

ERROR 18 Jul 2026 16:36:53 Shark - Activity[Process Id=1010_workflowVar_process1, Id=1028_1010_workflowVar_process1_activity1, ba=null, ActDefId=activity1] - failed to set the activity result
ERROR 18 Jul 2026 16:36:53 org.joget.workflow.model.service.WorkflowManagerImpl - {"thread":"http-nio-8080-exec-3","message":"","params":{"activityId":"1028_1010_workflowVar_process1_activity1","_FORM_META_ORIGINAL_ID":"3ee681c7-07ec-4a7c-8997-97cea28a8f5a"},"url":"http://localhost:8080/jw/WEB-INF/jsp/ubuilder/v5view.jsp?_action=assignmentSubmit&activityId=1028_1010_workflowVar_process1_activity1&OWASP-CSRFTOKEN=KB2N-CDM6-PTJZ-FUM5-QO0W-WFUT-EMLF-IDWN","username":"admin"}
org.enhydra.shark.api.client.wfmodel.UpdateNotAllowed: Activity [Process Id=1010_workflowVar_process1, Id=1028_1010_workflowVar_process1_activity1, ba=null, ActDefId=activity1] - context attribute username does not exist in the activity context - adding new attributes to activity context is not allowed
        at org.enhydra.shark.WfActivityImpl.setProcessContext(WfActivityImpl.java:531)
        at org.enhydra.shark.WfActivityImpl.set_result(WfActivityImpl.java:339)

Regression in the Readonly option in Form Menus for Joget DX 9.1.0.1

In Joget DX 9.1.0.1, a regression issue related to changes with the Readonly option, now being called Disabled in the new Write Permission dropdown. A temporary patch has been released to revert this, found here: Joget DX 9.1.0.1 Patch Announcement.

Database SQL Query action buttons placed outside of list tables do not trigger any action

In Joget DX 9.1-PREVIEW, there is a known defect where Database SQL Query action buttons placed outside of list tables do not trigger any action. This issue does not occur in earlier versions and is specific to the preview build. Consider using versions 9.0.x until a fix is released in a future stable version for version 9.1.

"Missing transition or start/end" and "Design is invalid" errors in Joget DX 9.0.7

In Joget DX 9.0.7, in Process Builder, renaming an activity ID and saving the process may trigger "Missing transition or start/end" and "Design is invalid" errors. To work around this, rename nodes before completing wiring or transitions. A fix is currently in development and will be included in the upcoming release.

Custom Styling in DX 9.0.4 is inconsistent, and styling cascades into form elements 

A new known issue has been identified in Joget DX 9.0.4 affecting users who apply custom styling via the Styling property in Form Builder and Form Elements using default styling. The default styling selector using a wildcard (*) is too broad and unintentionally cascades styles into all child elements, causing UI regressions, most notably in the Progressive Theme (checkbox field styling not reflected at runtime) and the Rich Text Editor (styles leaking into the TinyMCE toolbar). This issue will be addressed in an upcoming update.

Joget DX 9.0-SNAPSHOT - build e3812a19 encountered an error when in the Extra Filter Condition if the value input is e.id != 4

The following error message is returned in the system logs:

Cause:

This behavior is due to upgraded, stricter data type validation introduced in recent Hibernate updates embedded within Joget DX 9. Because the primary identifier or target field (e.id) is stored as a java.lang.String data type, Hibernate no longer automatically casts or allows direct comparison with unquoted numeric integers (java.lang.Integer).

Correct Syntax & Workaround:

To resolve this, explicitly pass the value as a string literal by wrapping it in single or double quotes, depending on the exact database dialect/quoting requirements

• Incorrect: e.id != 4
• Correct: e.id != '4' (or e.id != "4")

Datalist Rendering Error in Joget Enterprise Support App in Joget DX 9.0-SNAPSHOT Build fd3fdc8a

Users may encounter the following error message when attempting to render datalists in the Joget Enterprise Support app:

 The datalist fails to load in the UI, preventing normal usage.

Cause

• The issue is triggered by the File Link Datalist Formatter component.
• In affected builds, the formatter fails to render properly, resulting in the datalist not loading.