VYPR
← All advisories
High severityNVD Advisory· Published Sep 25, 2025· Updated Sep 26, 2025

CVE-2025-56769

CVE-2025-56769

Description

An issue was discovered in chinabugotech hutool before 5.8.4 allowing attackers to execute arbitrary expressions that lead to arbitrary method invocation and potentially remote code execution (RCE) via the QLExpressEngine class.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Hutool before 5.8.4 allows RCE via QLExpressEngine because the allowClassSet whitelist is not applied, enabling arbitrary method invocation.

Vulnerability

Overview

CVE-2025-56769 is a critical vulnerability in chinabugotech hutool versions before 5.8.4. The issue lies in the QLExpressEngine class, which is used to evaluate expressions. The engine fails to apply the allowClassSet parameter—a user-specified class whitelist—when executing expressions. This means that even if a caller provides a whitelist, it is ignored, and the engine falls back to its default blacklist mode, which can be bypassed [1][3].

Exploitation

An attacker can exploit this by crafting a malicious expression that invokes arbitrary methods on Java classes. The QLExpressEngine uses the ExpressRunner from QLExpress, which by default operates in blacklist mode. However, the blacklist is not comprehensive and can be circumvented. Since the allowClassSet is never passed to restrict allowed classes is never passed to engine.execute(), any method on any class can be called if it is not explicitly blacklisted [3]. The attack requires the ability to supply an expression string to the vulnerable API, such as through ExpressionUtil.eval() [3].

Impact

Successful exploitation allows an attacker to invoke arbitrary methods, potentially leading to remote code execution (RCE). An attacker could execute system commands, access sensitive data, or compromise the host system [1][3].

Mitigation

The vulnerability is fixed in hutool version 5.8.4. The fix enforces security risk method forbidding via QLExpressRunStrategy.setForbidInvokeSecurityRiskMethods(true) and explicitly blocks JNDI lookup calls. Additionally, the allowClassSet is now properly applied by iterating over allowed classes and adding their methods as secure methods [4]. Users should upgrade to hutool 5.8.4 or later.

References
  1. NVD - CVE-2025-56769
  2. Remote Code Execution (RCE) vulnerability disclosure in hutool
  3. 修复`QLExpressEngine`allowClassSet无效问题（issue#3994@Github） · chinabugotech/hutool@3d0d8de

AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
cn.hutool:hutool-extraMaven
< 5.8.405.8.40

Affected products

2

Patches

1
3d0d8dea4bc2

修复`QLExpressEngine`allowClassSet无效问题（issue#3994@Github）

https://github.com/chinabugotech/hutoolLoolyJul 22, 2025via ghsa
commit
2 files changed · +18 −0
  • CHANGELOG.md+1 −0 modified
    @@ -12,6 +12,7 @@
 * 【extra  】      `Sftp``reconnectIfTimeout`方法改为捕获所有异常（issue#3989@Github）
 * 【core   】      修复`ChineseDate `闰年闰月节日获取问题（issue#ICL1BT@Gitee）
 * 【core   】      修复`TreeBuilder`append重复向idTreeMap中put问题（pr#3992@Github）
+* 【extra  】      修复`QLExpressEngine`allowClassSet无效问题（issue#3994@Github）
 
 -------------------------------------------------------------------------------------------------------------
 # 5.8.39(2025-06-20)
  • hutool-extra/src/main/java/cn/hutool/extra/expression/engine/qlexpress/QLExpressEngine.java+17 −0 modified
    @@ -4,7 +4,10 @@
 import cn.hutool.extra.expression.ExpressionException;
 import com.ql.util.express.DefaultContext;
 import com.ql.util.express.ExpressRunner;
+import com.ql.util.express.config.QLExpressRunStrategy;
 
+import javax.naming.InitialContext;
+import java.lang.reflect.Method;
 import java.util.Collection;
 import java.util.Map;
 
@@ -24,10 +27,24 @@ public class QLExpressEngine implements ExpressionEngine {
 	 */
 	public QLExpressEngine() {
 		engine = new ExpressRunner();
+
+		// issue#3994@Github
+		// Enforce blacklisting of high-risk method invocations
+		QLExpressRunStrategy.setForbidInvokeSecurityRiskMethods(true);
+		// Explicitly forbid JNDI lookup calls through InitialContext
+		QLExpressRunStrategy.addSecurityRiskMethod(InitialContext.class, "doLookup");
 	}
 
 	@Override
 	public Object eval(final String expression, final Map<String, Object> context, Collection<Class<?>> allowClassSet) {
+		// issue#3994@Github
+		if (null != allowClassSet) {
+			for (Class<?> clazz : allowClassSet) {
+				for (Method method : clazz.getDeclaredMethods()) {
+					QLExpressRunStrategy.addSecureMethod(clazz, method.getName());
+				}
+			}
+		}
 		final DefaultContext<String, Object> defaultContext = new DefaultContext<>();
 		defaultContext.putAll(context);
 		try {

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.