CVE-2025-56769: Hutool RCE Vulnerability

CVE-2025-56769 Overview

CVE-2025-56769 affects Hutool, a widely used Java utility library maintained by chinabugotech. The vulnerability resides in the QLExpressEngine class and allows attackers to execute arbitrary expressions. Successful exploitation leads to arbitrary method invocation and potentially remote code execution (RCE). All Hutool versions before 5.8.4 are affected. The flaw is classified under [CWE-77] (Improper Neutralization of Special Elements used in a Command). The vulnerability is network-exploitable and requires no authentication or user interaction, though its impact is limited to partial confidentiality and integrity loss according to the assigned CVSS metrics.

Critical Impact
Attackers can execute arbitrary expressions through QLExpressEngine, leading to arbitrary method invocation and potential remote code execution in Java applications embedding vulnerable Hutool versions.

Affected Products

Hutool hutool versions prior to 5.8.4
Java applications embedding the cn.hutool.script or QLExpress integration components
Downstream libraries and services depending on vulnerable Hutool releases

Discovery Timeline

2025-09-25 - CVE-2025-56769 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-56769

Vulnerability Analysis

Hutool is a Java toolkit that bundles utilities including scripting and expression evaluation. The QLExpressEngine class wraps the QLExpress runtime, which evaluates dynamic expressions written in a Java-like syntax. In versions before 5.8.4, QLExpressEngine does not restrict which classes and methods can be resolved during expression evaluation. Attackers who control expression input can reference arbitrary Java classes and invoke their methods.

This behavior turns any endpoint that forwards untrusted input to QLExpressEngine into a code execution primitive. Reachable methods include reflection APIs and process execution utilities, providing a path to remote code execution on the underlying host.

Root Cause

The root cause is missing sandboxing of the QLExpress runtime configuration inside Hutool. The engine is initialized without a class or method whitelist and without disabling reflective access. As a result, expressions can traverse the Java class graph freely.

Attack Vector

Exploitation requires an application that passes attacker-controlled strings to QLExpressEngine.eval or a wrapper. The attacker submits a crafted expression that resolves sensitive classes such as java.lang.Runtime or java.lang.ProcessBuilder and invokes their methods to run arbitrary commands. No authentication is required when the vulnerable evaluation surface is exposed over the network.

The vulnerability is described in prose only. Refer to the GitHub issue report for technical detail on the reproduction case.

Detection Methods for CVE-2025-56769

Indicators of Compromise

Application logs showing evaluation of expressions containing references to Runtime, ProcessBuilder, Class.forName, or reflective invocation patterns.
Unexpected child processes spawned by the Java application user, such as shells or download utilities.
Outbound network connections from the JVM process to unfamiliar hosts shortly after expression evaluation.

Detection Strategies

Inventory application dependencies with a software composition analysis tool and flag Hutool versions below 5.8.4.
Instrument or review call sites that reach cn.hutool.script.QLExpressEngine and confirm whether user input can reach the eval method.
Deploy runtime application self-protection or Java security manager policies that alert on reflective process creation.

Monitoring Recommendations

Monitor JVM process trees for java spawning sh, cmd.exe, powershell.exe, or scripting interpreters.
Alert on WAF or reverse proxy logs containing expression syntax such as .getClass(), Runtime.getRuntime, or exec(.
Track dependency drift in CI pipelines to prevent reintroduction of vulnerable Hutool releases.

How to Mitigate CVE-2025-56769

Immediate Actions Required

Upgrade Hutool to version 5.8.4 or later across all applications and shaded dependencies.
Audit application code for any invocation of QLExpressEngine that accepts external input and gate it behind strict validation.
Rotate credentials and secrets accessible to affected JVM processes if exploitation is suspected.

Patch Information

The maintainer addressed the issue starting in Hutool 5.8.4. Update the hutool-all or component-specific artifact coordinates in Maven or Gradle build files. Reference the Hutool GitHub issue 3994 for the tracking discussion.

Workarounds

Remove or disable code paths that expose QLExpressEngine to untrusted input until patching is complete.
Implement an allowlist of expression tokens and reject any input containing method references, class literals, or reflective syntax.
Run the JVM with a restrictive SecurityManager policy or use Java Platform Module System restrictions to block reflective access to java.lang.Runtime and java.lang.ProcessBuilder.

bash

# Configuration example: enforce Hutool >= 5.8.4 in Maven
<dependency>
    <groupId>cn.hutool</groupId>
    <artifactId>hutool-all</artifactId>
    <version>5.8.4</version>
</dependency>