Detections
Analytics

CVE-2025-56769

critical

Description

An issue was discovered in chinabugotech hutool before 5.8.4 allowing attackers to execute arbitrary expressions that lead to arbitrary method invocation and potentially remote code execution (RCE) via the QLExpressEngine class.

References

https://github.com/advisories/GHSA-gcfh-36x4-mgj6

https://github.com/chinabugotech/hutool/issues/3994

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-31174

Details

Source: Mitre, NVD

Published: 2025-09-25

Updated: 2026-11-05

Risk Information

CVSS v2

Base Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Severity: Medium

CVSS v4

Base Score: 9.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: Critical

EPSS

EPSS: 0.0034