Vulnerability · Published Mar 22, 2025 · Assigned by VulDB

CVE-2025-2622aizuda snail-job Workflow-Task Management Module check-node-expression getRuntime deserialization

Medium 6.3

In plain English

A medium-severity unsafe deserialization in snail-job from aizuda. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.7%top 45.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in aizuda snail-job 1.4.0. It has been classified as critical. Affected is the function getRuntime of the file /snail-job/workflow/check-node-expression of the component Workflow-Task Management Module. The manipulation of the argument nodeExpression leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	com.aizuda:snail-job	no fix listed	GHSA-4m5h-5v4q-4xgq

Affected products (as reported)

Vendor	Product	Versions
aizuda	snail-job	1.4.0

Weakness: CWE-502, CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

VDB-300624 | aizuda snail-job Workflow-Task Management Module check-node-expression getRuntime deserialization vdb-entry, technical-description
VDB-300624 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #518999 | gitee/github snail-job 1.4.0 Command Injection third-party-advisory
https://gitee.com/aizuda/snail-job/issues/IBSQ24 exploit, issue-tracking
https://gitee.com/aizuda/snail-job/issues/IBSQ24#note_38500450_link issue-tracking