PDC Warning SECU0018 - Java code injection detected from OOTB pyExtractText

General
1

Hello Pega Community,

We are observing a recurring security warning in our Production environment and would appreciate any insights from the community regarding its cause and recommended resolution.

Environment

  • Warning frequency: Approximately 80 occurrences per hour
  • Application functionality involved: Document generation / text extraction
  • The warning appears to originate from a Pega out-of-the-box activity that is being invoked by our application.

PDC Warning Details

Warning Description

Java code injection detected : Pega RASP has detected a java injection (type warn)
Permission not granted (PROCESS_EXECUTE)

Vulnerable code:
java.base/java.lang.ProcessBuilder.start(ProcessBuilder.java)

Called from:
java.base/java.lang.Runtime.exec(Runtime.java:681)

Stack Trace (Excerpt)

RULE-OBJ-ACTIVITY RULE-FILE-BINARY PYEXTRACTTEXT
Step: 2
doActivity Rule-Obj-Activity: pyExtractText
Call pyExtractText
RULE-OBJ-ACTIVITY VDF-DE-ICPA-WORK-CANCELREISSUE
PROCESSAMENDEDINVOICES
Step: 1_6
30 additional frames in stack

Questions

  1. Is this a known behavior of the OOTB pyExtractText activity?
  2. What external process or executable is Pega attempting to invoke through Runtime.exec()?
  3. Is this expected to trigger a Pega RASP “Java Code Injection Detected” warning, or could it indicate a configuration issue?
  4. Has anyone encountered similar warnings related to pyExtractText or document text extraction functionality?
  5. Are there any Pega hotfixes, product updates, or recommended configuration changes to address or suppress these warnings?
  6. Is there any security concern if the warning originates solely from an OOTB Pega activity?

Any guidance on the root cause, expected behavior, or recommended next steps would be greatly appreciated.

Thank you in advance for your help.

2

The warning is most likely not a security attack, but rather Pega RASP blocking an attempt by the OOTB pyExtractText activity to execute an external process via Runtime.exec() used for document text extraction.

pyExtractText is an OOTB activity responsible for extracting text from document attachments.The PROCESS_EXECUTE warning indicates that RASP blocked an external process execution—it does not necessarily mean Java code was injected.

If this is Pega Cloud, process execution is often intentionally restricted. An OOTB activity attempting to call an external executable may therefore generate warnings even though the platform continues to function.

The high frequency suggests a recurring background process or repeated retries attempting text extraction.

Verify whether document text extraction is working as expected, review logs to identify the executable being invoked, and check if a scheduler or queue processor is repeatedly triggering the activity.

The actual exception is often 20–50 lines earlier than the RASP warning.

Look for:

Cannot execute or IOException or Cannot run program

Those messages usually include the executable name.