CVE-2024-3366: Xuxueli xxl-job template injection vulnerability

The vulnerability centers around insecure deserialization in JdkSerializeTool.java. The deserialize method directly uses ObjectInputStream.readObject() on untrusted input, which is a well-known anti-pattern for Java applications. This allows arbitrary object deserialization attacks. While other utility classes (ScriptUtil, FileUtil) are mentioned as exploitation vectors, the root cause is the insecure deserialization in JdkSerializeTool. The CWE-74 classification and public exploit POC confirm this is an injection vulnerability stemming from improper input neutralization during deserialization. The GitHub issue #3391 explicitly links template injection attacks to this deserialization weakness as the entry point.