An issue was discovered in chinabugotech hutool before 5.8.4 allowing attackers to execute arbitrary expressions that lead to arbitrary method invocation and potentially remote code execution (RCE) via the QLExpressEngine class.
CVE-2025-56769
CVSS base score
6.5 (v3.1)
Severity
MEDIUM
Attack vector
Network
Weakness
CWE-77
Last modified
November 5, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
hutool hutool
References
- github.com Exploit, Issue Tracking, Patch