CVE-2025-14674

MediumCVSS 6.3

Published: 14/12/2025(UTC)Updated: 28/09/2026(UTC)Translated: 28/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.33%

23th percentile - higher than 23% of all known CVEs

Summary

A vulnerability was found in aizuda snail-job up to 1.6.0, affecting the function QLExpressEngine.doEval in QLExpressEngine.java. The manipulation results in injection, and the attack can be launched remotely. Upgrading to version 1.7.0-beta1 addresses this issue.

Risk Assessment

An attacker can remotely perform unauthorized operations in the system, potentially leading to data integrity compromise or takeover of the application.

Recommendation

Upgrade snail-job to version 1.7.0-beta1 or later as soon as possible, as it contains the fix.

Other vulnerabilities in aizuda snail-job

CVE-2025-15246Medium
A vulnerability was determined in aizuda snail-job up to 1.7.0 on macOS. Affected by this vulnerability is the function FurySerializer.deserialize of the component API. This manipulation of the argument argsStr causes deserialization. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

Original NVD description (English source)

A vulnerability was found in aizuda snail-job up to 1.6.0. Affected by this vulnerability is the function QLExpressEngine.doEval of the file snail-job-common/snail-job-common-core/src/main/java/com/aizuda/snailjob/common/core/expression/strategy/QLExpressEngine.java. The manipulation results in injection. The attack can be launched remotely. Upgrading to version 1.7.0-beta1 addresses this issue. The patch is identified as 978f316c38b3d68bb74d2489b5e5f721f6675e86. The affected component should be upgraded.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS