SnailJob CVE-2025-14674

Requires authenticated access to snail-job (CVSS PR:L) and the ability to reach a code path that feeds attacker-controlled input into QLExpressEngine.doEval - i.e., a snail-job feature that evaluates user-supplied QLExpress expressions (such as job workflow/decision or routing expression fields). Exploitation targets deployments running snail-job version 1.6.0 or earlier; no user interaction is required (UI:N). The primary limiting factors are the authentication requirement (not exploitable pre-auth) and dependence on exposure of an expression-evaluation feature to the authenticated attacker.

The only quantitative signal provided is the vendor (VulDB) CVSS 4.0 base vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L (5.3, Medium). This describes a network-reachable, low-complexity flaw requiring low-level authentication (PR:L) with limited confidentiality/integrity/availability impact and no scope change. No EPSS probability, no CISA KEV listing, and no explicitly claimed proof-of-concept are present in the input, so exploitation is not confirmed in the wild. The most notable tension is between the modest vendor impact rating (all sub-metrics 'Low') and the underlying weakness class: CWE-74 injection into the QLExpress expression engine (QLExpressEngine.doEval). QLExpress evaluates dynamic expressions and can commonly invoke Java methods, so an unsandboxed expression injection often escalates to arbitrary code execution - which would justify considerably higher impact than VC:L/VI:L/VA:L. The vendor's Low rating may reflect a constrained/sandboxed evaluation context, but this is not stated and should be verified against the patch (commit 978f316c) and the linked Gitee issue ICNUG0. Net: this is a real, patch-available injection flaw but not a widespread-exploitation emergency - the PR:L authentication requirement and absence of KEV/EPSS/POC signals keep real-world priority low-to-moderate, with the caveat that actual impact could be higher than the published score if the expression engine reaches arbitrary Java execution.

An authenticated user of the snail-job console/API submits a crafted expression (e.g., in a job trigger, routing, or workflow decision field) that is passed to QLExpressEngine.doEval, causing the QLExpress engine to evaluate attacker-controlled logic on the server. Depending on how tightly the engine is sandboxed, this yields at minimum information/logic manipulation and potentially arbitrary Java method invocation. No public exploit code is identified in the provided data, though a fix commit and issue thread are public.