CVE-2025-15246
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A vulnerability was determined in aizuda snail-job up to 1.7.0 on macOS. Affected by this vulnerability is the function FurySerializer.deserialize of the component API. This manipulation of the argument argsStr causes deserialization. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
Risk Assessment
An attacker can remotely trigger unsafe deserialization, potentially leading to arbitrary code execution on the server or application takeover.
Recommendation
Update snail-job to the latest patched version. Restrict API access and filter input data passed to deserialization.
Other vulnerabilities in aizuda snail-job
Original NVD description (English source)
A vulnerability was determined in aizuda snail-job up to 1.7.0 on macOS. Affected by this vulnerability is the function FurySerializer.deserialize of the component API. This manipulation of the argument argsStr causes deserialization. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS