aizuda snail-job CVE-2025-15246

Q: What is the CVSS score of CVE-2025-15246?

CVE-2025-15246 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

LOW

Improper Input Validation (CWE-20)

2025-12-30 cna@vuldb.com

Deserialization Apple

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-accessible API with low-privilege access, no user interaction, and low impact on all three CIA pillars.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 15:45 vuln.today

DescriptionCVE.org

A vulnerability was determined in aizuda snail-job up to 1.7.0 on macOS. Affected by this vulnerability is the function FurySerializer.deserialize of the component API. This manipulation of the argument argsStr causes deserialization. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

AnalysisAI

Deserialization vulnerability in aizuda snail-job up to version 1.7.0 on macOS allows remote attackers with low privileges to execute arbitrary code by supplying malicious serialized data to the argsStr argument of the FurySerializer.deserialize function. Public exploit code is available, though no active exploitation has been confirmed at the time of analysis.

Technical ContextAI

The flaw resides in the API component's use of a FurySerializer deserialization routine (likely using a format such as Fury, a Java serialization framework) that accepts user-controlled input via the argsStr parameter without sufficient validation, leading to CWE-20 (Improper Input Validation) and enabling unsafe deserialization. Snail-job is an open-source distributed job scheduling platform, and although no CPE strings are provided, the vulnerability specifically affects the macOS deployment up to version 1.7.0, with the CVSS 4.0 vector indicating network reachability, low privileges required, and limited impact on confidentiality, integrity, and availability.

Affected ProductsAI

aizuda snail-job versions up to and including 1.7.0 on macOS are vulnerable. The vendor’s Gitee issue tracker (https://gitee.com/aizuda/snail-job/issues/ICQV61) serves as the primary advisory for this issue. No CPE or additional version details are available at this time.

RemediationAI

No official patch version has been released as of this analysis. Monitor the Gitee issue (https://gitee.com/aizuda/snail-job/issues/ICQV61) for updates. As a temporary workaround, restrict network access to the Snail‑job API endpoint to trusted hosts only, and implement strict input validation or deserialization filtering (e.g., using a safe deserialization whitelist) to mitigate the risk. Disabling the affected API functionality, if feasible, would eliminate the attack surface but may impact job scheduling operations-assess operational impact before applying.