Floci fixes critical SSTI RCE CVE-2026-108598 in 2.2.0

The open-source AWS API Gateway emulator Floci patched CVE-2026-108598 (CVSS 9.8), a server-side template injection flaw that lets unauthenticated attackers run OS commands via a Velocity mapping template in a MOCK integration. Versions 1.1.0 through 2.1.x are affected; the fix ships in 2.2.0. A public proof-of-concept is already available.

• CVSS 9.8: unauthenticated remote OS command execution
• Floci 1.1.0–2.1.x affected, fixed in 2.2.0
• Single request with a $util Velocity template triggers RCE
• Public PoC published; no in-the-wild exploitation confirmed