What is the CVSS score of CVE-2025-53639?

CVE-2025-53639 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Java are affected by CVE-2025-53639?

MeterSphere versions prior to 3.6.5-lts contain a critical SQL injection vulnerability in the API sorting functionality that allows unauthenticated attackers to execute arbitrary database commands…. A patch is available.

How to fix or mitigate CVE-2025-53639?

Within 24 hours: Identify all MeterSphere instances and document current versions. Within 7 days: Upgrade all instances to version 3.6.5-lts or later; if immediate upgrade is not feasible, implement network-level access controls restricting API access to trusted sources only. Within 30 days: Conduct database audit for unauthorized access or modifications; review API logs for exploitation attempts and validate backup integrity.

Java CVE-2025-53639

EUVD-2025-21386 CRITICAL

SQL Injection (CWE-89)

2025-07-14 security-advisories@github.com

SQLi Java Metersphere

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:51 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

3.6.5-lts

EUVD ID Assigned

Mar 16, 2026 - 09:43 euvd

EUVD-2025-21386

Analysis Generated

Mar 16, 2026 - 09:43 vuln.today

CVE Published

Jul 14, 2025 - 20:15 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

MeterSphere is an open source continuous testing platform. Prior to version 3.6.5-lts, the sortField parameter in certain API endpoints is not properly validated or sanitized. An attacker can supply crafted input to inject and execute arbitrary SQL statements through the sorting functionality. This could result in modification or deletion of database contents, with a potential full compromise of the application’s database integrity and availability. Version 3.6.5-lts fixes the issue.

AnalysisAI

CVE-2025-53639 is a critical SQL injection vulnerability in MeterSphere's API sorting functionality where the sortField parameter lacks proper input validation and sanitization. All versions prior to 3.6.5-lts are affected, allowing unauthenticated remote attackers to execute arbitrary SQL statements and completely compromise database integrity, availability, and confidentiality. This is a network-exploitable vulnerability with no authentication required and high real-world risk.

Technical ContextAI

The vulnerability exists in MeterSphere (CPE: cpe:2.3:a:metersphere:metersphere:*:*:*:*:*:*:*:*), an open-source continuous testing platform written in Java. The root cause is classified under CWE-89 (SQL Injection), specifically improper neutralization of special elements used in an SQL command. The sortField parameter in multiple API endpoints is passed directly into SQL ORDER BY clauses or similar database query construction without parameterized queries or input validation. The application fails to use prepared statements with bound parameters, instead concatenating user-supplied input directly into dynamic SQL queries. This is a classic second-order or direct SQL injection vulnerability in the sorting/filtering layer.

RemediationAI

{'type': 'Patch', 'action': 'Upgrade MeterSphere to version 3.6.5-lts or later', 'priority': 'CRITICAL', 'details': 'The patched version 3.6.5-lts implements proper input validation and sanitization of the sortField parameter, likely through parameterized queries, allowlist validation, or input escaping.'} {'type': 'Immediate Mitigation', 'action': 'If immediate patching is not possible, implement WAF rules to block requests containing SQL keywords in sortField parameter values', 'details': 'Block requests where sortField contains: UNION, SELECT, DROP, INSERT, UPDATE, DELETE, OR, AND, --, /*. This is a temporary measure only.'} {'type': 'Detection', 'action': 'Monitor API access logs for suspicious sortField values containing SQL syntax or special characters', 'details': 'Search for patterns: semicolons, comment sequences (--, /*), SQL keywords, UNION statements in sortField parameter logs.'} {'type': 'Access Control', 'action': 'If running vulnerable versions, restrict network access to MeterSphere APIs to trusted internal networks only', 'details': 'Disable external/internet-facing access until patching is complete.'}