Vulnerability · Published Dec 30, 2025 · Assigned by VulDB
CVE-2025-15246aizuda snail-job API FurySerializer.deserialize deserialization
Medium 6.3
In plain English
A medium-severity unsafe deserialization in snail-job from aizuda. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.3%top 78.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability was determined in aizuda snail-job up to 1.7.0 on macOS. Affected by this vulnerability is the function FurySerializer.deserialize of the component API. This manipulation of the argument argsStr causes deserialization. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
Affected products (as reported)
Weakness: CWE-502, CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-338636 | aizuda snail-job API FurySerializer.deserialize deserialization vdb-entry, technical-description
- VDB-338636 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- https://gitee.com/aizuda/snail-job/issues/ICQV61 exploit, issue-tracking
- https://gitee.com/aizuda/snail-job/ product