CVE-2025-14674: snail-job is vulnerable to Code Injection through QLExpressEngine.doEval function
(updated )
A vulnerability was found in aizuda snail-job up to 1.6.0. Affected by this vulnerability is the function QLExpressEngine.doEval of the file snail-job-common/snail-job-common-core/src/main/java/com/aizuda/snailjob/common/core/expression/strategy/QLExpressEngine.java. The manipulation results in injection. The attack can be launched remotely. Upgrading to version 1.7.0-beta1 addresses this issue. The patch is identified as 978f316c38b3d68bb74d2489b5e5f721f6675e86. The affected component should be upgraded.
References
- gitee.com/aizuda/snail-job/commit/978f316c38b3d68bb74d2489b5e5f721f6675e86
- gitee.com/aizuda/snail-job/issues/ICNUG0
- gitee.com/aizuda/snail-job/issues/ICNUG0
- gitee.com/aizuda/snail-job/releases/tag/vsj1.7.0-beta1
- github.com/advisories/GHSA-3f8c-8h8v-p54h
- github.com/aizuda/snail-job
- nvd.nist.gov/vuln/detail/CVE-2025-14674
- vuldb.com/?ctiid.336403
- vuldb.com/?id.336403
Code Behaviors & Features
Detect and mitigate CVE-2025-14674 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →