N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-56769

CVE-2025-56769: Hutool allows remote code execution (RCE) via the QLExpressEngine class

An issue was discovered in chinabugotech hutool before 5.8.40 allowing attackers to execute arbitrary expressions that lead to arbitrary method invocation and potentially remote code execution (RCE) via the QLExpressEngine class.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-56769

CVE-2025-56769:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
cn.hutool:hutool-extra	maven	< 5.8.40	5.8.40

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the QLExpressEngine class, which is part of the hutool-extra package. The core of the issue lies in the eval method, which is responsible for evaluating expressions. Before the patch, this method did not properly enforce any restrictions on the code being executed, allowing an attacker to invoke arbitrary Java methods. This could be leveraged for Remote Code Execution (RCE) by calling dangerous methods, such as javax.naming.InitialContext.doLookup, to perform a JNDI injection attack.

The security patch addresses this in two ways:

It modifies the QLExpressEngine constructor to enable a security manager (QLExpressRunStrategy.setForbidInvokeSecurityRiskMethods(true)) and explicitly blacklist the potentially harmful doLookup method from the InitialContext class.
It enhances the eval method to respect the allowClassSet parameter, which acts as a whitelist for permissible classes and their methods during expression evaluation.

Therefore, the primary vulnerable function is cn.hutool.extra.expression.engine.qlexpress.QLExpressEngine.eval as it's the entry point for the malicious expression. The constructor cn.hutool.extra.expression.engine.qlexpress.QLExpressEngine.QLExpressEngine is also relevant as its lack of security initialization is a key part of why the vulnerability was exploitable.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.