Vulnerability · Published Dec 9, 2025 · Assigned by GitHub_M

CVE-2025-66214Ladybug has an XMLDecoder Deserialization Vulnerability (Java RCE)

High 7.0

In plain English

A high-severity unsafe deserialization in ladybug from wearefrank. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)7.0High

Exploit odds (30 days)0.3%top 73.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Ladybug adds message-based debugging, unit, system, and regression testing to Java applications. Versions prior to 3.0-20251107.114628 contain the APIs /iaf/ladybug/api/report/{storage} and /iaf/ladybug/api/report/upload, which allow uploading gzip-compressed XML files with user-controllable content. The system deserializes these XML files, enabling attackers to achieve Remote Code Execution (RCE) by submitting carefully crafted XML payloads and thereby gain access to the target server. This issue is fixed in version 3.0-20251107.114628.

Affected products (as reported)

Vendor	Product	Versions
wearefrank	ladybug	< 3.0-20251107.114628

Weakness: CWE-502 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L

References

https://github.com/wearefrank/ladybug/security/advisories/GHSA-f9fh-r3cv-398f x_refsource_CONFIRM