PT-2025-39463 · Hutool · Hutool

Adv851 · Published 2025-09-25 · Updated 2025-10-03 · CVE-2025-56769

Positive Technologies (AI Summary)

CVSS v4.0

8.9

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

Name of the Vulnerable Software and Affected Versions hutool versions prior to 5.8.4

Description An issue exists in the QLExpressEngine class that allows attackers to execute arbitrary expressions, potentially leading to arbitrary method invocation and remote code execution (RCE).

Recommendations Update to a version newer than 5.8.4.

Fix

RCE

Command Injection

Weakness Enumeration

CWE-917

CWE-77

Related Identifiers

CVE-2025-56769

GHSA-GCFH-36X4-MGJ6

Affected Products

Hutool

References · 11

• https://github.com/chinabugotech/hutool/issues/3994 · Patch
• https://osv.dev/vulnerability/CVE-2025-56769 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-56769 · Security Note
• https://osv.dev/vulnerability/GHSA-gcfh-36x4-mgj6 · Vendor Advisory
• https://github.com/chinabugotech/hutool · Note
• https://github.com/chinabugotech/hutool/commit/3d0d8dea4bc2fac2e9b45dc67244195f30e42e4b · Note
• https://t.me/cveNotify/136467 · Telegram Post
• https://t.me/CVEtracker/33386 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1971358587889877110 · Twitter Post
• https://t.me/cveNotify/137366 · Telegram Post
• https://twitter.com/CVEnew/status/1971346618742902811 · Twitter Post