Vulnerability · Published Sep 8, 2025 · Assigned by VulDB

CVE-2025-10080running-elephant Datart API AESUtil.java getTokensecret hard-coded key

Low 3.1

In plain English

A low-severity security flaw in Datart from running-elephant. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)0.3%top 82.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in running-elephant Datart up to 1.0.0-rc3. Affected by this issue is the function getTokensecret of the file datart/security/src/main/java/datart/security/util/AESUtil.java of the component API. The manipulation leads to use of hard-coded cryptographic key . The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

Vendor	Product	Versions
running-elephant	Datart	1.0.0-rc11.0.0-rc21.0.0-rc3

Weakness: CWE-321, CWE-320 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References

VDB-323028 | running-elephant Datart API AESUtil.java getTokensecret hard-coded key vdb-entry, technical-description
VDB-323028 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #644631 | Elephant Datart 1.0.0-rc3 Insecure Storage of Sensitive Information third-party-advisory
https://github.com/yjk12/Elephant-Datart-/tree/main exploit