GitHub Advisoryadvisory · Maven

GHSA-4m5h-5v4q-4xgq aizuda snail-job Vulnerable to Deserialization via `nodeExpression` Argument

MEDIUM Published 2025-03-22 Modified 2025-03-24 Official page ↗
Aliases
CVE-2025-2622
Ecosystem
Maven
Packages
com.aizuda:snail-job
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-20, CWE-502
Reviewed
2025-03-24

Affected packages

• Maven com.aizuda:snail-job: 1.4.0 (no fix yet)

Description

A vulnerability was found in aizuda snail-job 1.4.0. It has been classified as critical. Affected is the function getRuntime of the file /snail-job/workflow/check-node-expression of the component Workflow-Task Management Module. The manipulation of the argument nodeExpression leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Related

Alias · CVE (1)

  • CVE-2025-2622 A vulnerability was found in aizuda snail-job 1.4.0. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-502 Deserialization of Untrusted Data weakness

References