Jouko Pynnönen has discovered an argument injection vulnerability in Java Web Start. I’ve just created a new Blackdown security advisory about this problem. Note that our current releases are not affected.