{"action":"Upgrade cn.hutool:hutool-extra to 5.8.40 or later.","affected":[{"fixed":"5.8.40","introduced":"0"}],"component":"cn.hutool:hutool-extra","cve_ids":["CVE-2025-56769"],"ecosystem":"Maven","epss":0.0034,"exploited":false,"fixed_versions":["5.8.40"],"ghsa_id":"GHSA-gcfh-36x4-mgj6","id":"tcs_01M5N8Y0VMSBDHQKRHG3G4ZHWM","modified_at":"2025-09-26T15:44:27.941365Z","published_at":"2025-09-26T00:31:19Z","references":["https://osv.dev/vulnerability/GHSA-gcfh-36x4-mgj6","https://nvd.nist.gov/vuln/detail/CVE-2025-56769","https://github.com/chinabugotech/hutool/issues/3994","https://github.com/chinabugotech/hutool/commit/3d0d8dea4bc2fac2e9b45dc67244195f30e42e4b","https://github.com/chinabugotech/hutool"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-gcfh-36x4-mgj6","url":"https://osv.dev/vulnerability/GHSA-gcfh-36x4-mgj6"},{"source":"nvd","source_id":"CVE-2025-56769","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-56769"}],"summary":"Hutool allows remote code execution (RCE) via the QLExpressEngine class"}