CVE-2025-2622: aizuda snail-job Workflow-Task Management Module check-node-expression getRuntime deserialization
First published: Sat Mar 22 2025(Updated: )
A vulnerability was found in aizuda snail-job 1.4.0. It has been classified as critical. Affected is the function getRuntime of the file /snail-job/workflow/check-node-expression of the component Workflow-Task Management Module. The manipulation of the argument nodeExpression leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Credit: cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| aizuda snail-job | ||
| maven/com.aizuda:snail-job | =1.4.0 | |
| aizuda snail-job | =1.4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://vuldb.com/?id.300624
- https://vuldb.com/?ctiid.300624
- https://vuldb.com/?submit.518999
- https://gitee.com/aizuda/snail-job/issues/IBSQ24
- https://gitee.com/aizuda/snail-job/issues/IBSQ24#note_38500450_link
- https://nvd.nist.gov/vuln/detail/CVE-2025-2622
- https://github.com/advisories/GHSA-4m5h-5v4q-4xgq (Advisory)
Frequently Asked Questions
What is the severity of CVE-2025-2622?
CVE-2025-2622 has been classified as critical.
What component is affected by CVE-2025-2622?
The affected component is the Workflow-Task Management Module of aizuda snail-job.
How does CVE-2025-2622 exploit the system?
CVE-2025-2622 exploits vulnerabilities in the function getRuntime by manipulating the nodeExpression argument.
What version of aizuda snail-job is impacted by CVE-2025-2622?
CVE-2025-2622 affects aizuda snail-job version 1.4.0.
What should users of aizuda snail-job do regarding CVE-2025-2622?
Users should review their implementation of the Workflow-Task Management Module and apply security patches as recommended.
- agent/title
- agent/weakness
- agent/first-publish-date
- agent/description
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/author
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/references
- agent/source
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-4m5h-5v4q-4xgq
- alias/CVE-2025-2622
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- agent/tags
- agent/softwarecombine
- collector/nvd-cve
- agent/event
- collector/github-advisory
- vendor/aizuda
- canonical/aizuda snail-job
- package-manager/maven
- version/aizuda snail-job/1.4.0