GHSA-gcfh-36x4-mgj6

ghsaUSosv

Hutool allows remote code execution (RCE) via the QLExpressEngine class

view advisory published 2025-09-26Licence: CC-BY-4.0

An issue was discovered in chinabugotech hutool before 5.8.40 allowing attackers to execute arbitrary expressions that lead to arbitrary method invocation and potentially remote code execution (RCE) via the QLExpressEngine class.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-56769US	—	0.34% (27th)	—	2025-09-25
An issue was discovered in chinabugotech hutool before 5.8.4 allowing attackers to execute arbitrary expressions that lead to arbitrary method invocation and potentially remote cod…

references

External citations — patches, advisories, analysis.

https://github.com/chinabugotech/hutoolPACKAGE
https://github.com/chinabugotech/hutool/commit/3d0d8dea4bc2fac2e9b45dc67244195f30e42e4bWEB
https://github.com/chinabugotech/hutool/issues/3994WEB
https://nvd.nist.gov/vuln/detail/CVE-2025-56769ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan