What is GHSA-gcfh-36x4-mgj6?

GHSA-gcfh-36x4-mgj6 is a security advisory published by GitHub Security Advisories with High severity. Hutool allows remote code execution (RCE) via the QLExpressEngine class

Which CVE IDs does GHSA-gcfh-36x4-mgj6 cover?

GHSA-gcfh-36x4-mgj6 covers the following CVE IDs: CVE-2025-56769. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-gcfh-36x4-mgj6?

GHSA-gcfh-36x4-mgj6 affects 1 product, including: maven/cn.hutool:hutool-extra:\u003c 5.8.40.

GHSA-gcfh-36x4-mgj6High

Hutool allows remote code execution (RCE) via the QLExpressEngine class

Vendor

GitHub Security Advisories

Published

September 26, 2025

Last Modified

September 26, 2025

🔗 CVE IDs covered (1)

CVE-2025-56769 →

📋 Description

An issue was discovered in chinabugotech hutool before 5.8.40 allowing attackers to execute arbitrary expressions that lead to arbitrary method invocation and potentially remote code execution (RCE) via the QLExpressEngine class.

🎯 Affected products1

maven/cn.hutool:hutool-extra:< 5.8.40

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-56769
https://github.com/chinabugotech/hutool/issues/3994
https://github.com/chinabugotech/hutool/commit/3d0d8dea4bc2fac2e9b45dc67244195f30e42e4b
https://github.com/advisories/GHSA-gcfh-36x4-mgj6