CVE-2025-14674 aizuda snail-job QLExpressEngine.java QLExpressEngine.doEval injection
Remote attackers can execute arbitrary code via injection in the QLExpressEngine evaluation function of the snail-job library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-14674?
CVE-2025-14674 is a medium-severity code injection vulnerability in aizuda snail-job, published on 14 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability was found in aizuda snail-job up to 1.6.0. Affected by this vulnerability is the function QLExpressEngine.doEval of the file snail-job-common/snail-job-common-core/src/main/java/com/aizuda/snailjob/common/core/expression/strategy/QLExpressEngine.java. The manipulation results in injection. The attack can be launched remotely. Upgrading to version 1.7.0-beta1 addresses this issue. The patch is identified as 978f316c38b3d68bb74d2489b5e5f721f6675e86. The affected component should be upgraded.
Which versions are affected by CVE-2025-14674?
2 open source packages ship an affected version, including com.aizuda:snail-job.
| Package | Affected | Fixed in |
|---|---|---|
com.aizuda:snail-job Maven | All versions | 1.7.0-beta1 |
com.aizuda:snail-job Maven | All versions | 1.7.0-beta1 |
How do I fix CVE-2025-14674?
Upgrade com.aizuda:snail-job to 1.7.0-beta1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-14674 being exploited?
There is no known exploitation of CVE-2025-14674 in the wild and no public exploit code.
Sources
Also known as GHSA-3f8c-8h8v-p54h.