PT-2025-51174 · Aizuda · Snail-Job

Published 2025-12-14 · Updated 2025-12-15 · CVE-2025-14674

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions aizuda snail-job versions up to 1.6.0

Description A flaw exists in the QLExpressEngine.doEval function within the snail-job-common/snail-job-common-core/src/main/java/com/aizuda/snailjob/common/core/expression/strategy/QLExpressEngine.java file. This allows for injection attacks, which can be initiated remotely. The vulnerability is addressed by upgrading to version 1.7.0-beta1, identified by the patch 978f316c38b3d68bb74d2489b5e5f721f6675e86.

Recommendations Upgrade to version 1.7.0-beta1.

Fix

Improper Neutralization

Special Elements Injection

Weakness Enumeration

CWE-707

CWE-74

Related Identifiers

CVE-2025-14674

GHSA-3F8C-8H8V-P54H

Affected Products

Snail-Job

References · 14

• https://gitee.com/aizuda/snail-job/releases/tag/vsj1.7.0-beta1 · Patch
• https://osv.dev/vulnerability/GHSA-3f8c-8h8v-p54h · Vendor Advisory
• https://gitee.com/aizuda/snail-job/commit/978f316c38b3d68bb74d2489b5e5f721f6675e86 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-14674 · Security Note
• https://github.com/aizuda/snail-job · Note
• https://gitee.com/aizuda/snail-job · Note
• https://t.me/cveNotify/145719 · Telegram Post
• https://gitee.com/aizuda/snail-job/issues/ICNUG0 · Note
• https://gitee.com/aizuda/snail-job/issues/ICNUG0#note_44321424_link · Note
• https://vuldb.com/?ctiid.336403 · Note
• https://twitter.com/CVEnew/status/2000611261122576520 · Twitter Post
• https://vuldb.com/?id.336403 · Note
• https://twitter.com/VulmonFeeds/status/2000279725848027194 · Twitter Post
• https://t.me/CVEtracker/39781 · Telegram Post