{"cve":"CVE-2025-14674","nvd":{"published":"2025-12-14T18:15:43.977","modified":"2026-09-28T10:10:00.473","status":"Deferred","description":"A vulnerability was found in aizuda snail-job up to 1.6.0. Affected by this vulnerability is the function QLExpressEngine.doEval of the file snail-job-common/snail-job-common-core/src/main/java/com/aizuda/snailjob/common/core/expression/strategy/QLExpressEngine.java. The manipulation results in injection. The attack can be launched remotely. Upgrading to version 1.7.0-beta1 addresses this issue. The patch is identified as 978f316c38b3d68bb74d2489b5e5f721f6675e86. The affected component should be upgraded.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","score":5.3},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","score":6.3},"cwes":["CWE-74","CWE-707"],"references":["https://gitee.com/aizuda/snail-job/","https://gitee.com/aizuda/snail-job/commit/978f316c38b3d68bb74d2489b5e5f721f6675e86","https://gitee.com/aizuda/snail-job/issues/ICNUG0","https://gitee.com/aizuda/snail-job/issues/ICNUG0#note_44321424_link","https://gitee.com/aizuda/snail-job/releases/tag/vsj1.7.0-beta1"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:17:07.138532058+00:00"},"epss":{"cve":"CVE-2025-14674","score":0.00329,"percentile":0.26069,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-3f8c-8h8v-p54h","url":"https://osv.dev/vulnerability/GHSA-3f8c-8h8v-p54h","summary":"snail-job is vulnerable to Code Injection through QLExpressEngine.doEval function","modified":"2025-12-16T01:11:16.212860Z","packages":[{"ecosystem":"Maven","name":"com.aizuda:snail-job","purl":"pkg:maven/com.aizuda/snail-job","ranges":["<1.7.0-beta1"],"fixed":["1.7.0-beta1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}