CVE-2025-56769 Hutool allows remote code execution (RCE) via the QLExpressEngine class

What is CVE-2025-56769?

CVE-2025-56769 is a medium-severity code injection vulnerability in n/a, published on 25 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in chinabugotech hutool before 5.8.4 allowing attackers to execute arbitrary expressions that lead to arbitrary method invocation and potentially remote code execution (RCE) via the QLExpressEngine class.

Weakness: CWE-77

Which versions are affected by CVE-2025-56769?

2 open source packages ship an affected version, including cn.hutool:hutool-extra. It affects 1 product.

Products include Hutool Hutool.

How do I fix CVE-2025-56769?

Upgrade cn.hutool:hutool-extra to 5.8.40 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2025-56769 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-56769 exists.

Other vulnerabilities in n/a

• CVE-2023-42276 hutool Buffer Overflow vulnerability Critical 9.8
• CVE-2023-42277 hutool Buffer Overflow vulnerability Critical 9.8
• CVE-2023-24162 Dromara Hutool Deserialization of Untrusted Data vulnerability Critical 9.8
• CVE-2023-24163 Dromara hutool vulnerable to SQL Injection Critical 9.8
• CVE-2022-22885 Improper Certificate Validation in Hutool Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gcfh-36x4-mgj6.