EUVD-2026-21729
GHSA-822v-8w6h-5jxp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as application user
-
DeliveryCraft SpEL injection payload in workflow definition
-
ExploitSubmit malicious definition to /warm-flow/save-json endpoint
-
ExecutionSpelHelper.parseExpression evaluates payload
-
PersistArbitrary code executes
-
ImpactSystem compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 6.3 score with Network-based attack vector and Low authentication requirement indicates moderate real-world risk. The CVSS vector shows AC:L (low complexity) and no user interaction required, meaning straightforward exploitation is possible. Exploitation probability is further elevated by the PE:P indicator confirming public proof-of-concept code exists, combined with EPSS data typical for code injection flaws (likely 70-85% exploitation likelihood). However, the PR:L (low privilege) requirement constrains the attack surface to authenticated users, reducing the immediate blast radius compared to unauthenticated RCE. The impact scope is unchanged (S:U), affecting only the vulnerable application, not system-wide. KEV status is not confirmed, suggesting no evidence of active exploitation in the wild at the time of advisory, but public POC availability means exploitation could begin rapidly if deployments are not patched. This is a genuine priority for any organization running warm-flow versions up to 1.8.4, particularly in environments where SpEL expressions are user-configurable. |
| Exploit ScenarioDerived | An authenticated user with workflow definition creation or modification privileges submits a malicious workflow definition to the /warm-flow/save-json endpoint. The payload contains a crafted SpEL expression in the skipCondition parameter, such as #{T(java.lang.Runtime).getRuntime().exec('command')}, which is passed to SpelHelper.parseExpression without sanitization. The expression is evaluated during workflow processing, causing arbitrary system command execution with the privileges of the application runtime. Public POC code demonstrating this exploitation is available, enabling attackers to quickly develop working attacks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 12, 2026
Remote code injection in Dromara warm-flow up to version 1.8.4 allows authenticated attackers to execute arbitrary code through the SpelHelper.parseExpression function via manipulation of listenerPath, skipCondition, or permissionFlag parameters in the Workflow Definition Handler. The vulnerability uses SpEL (Spring Expression Language) injection to achieve code execution with CVSS 6.3 severity. Publicly available exploit code exists and the flaw has been documented in the project's issue tracker.
RemediationAI
Upgrade Dromara warm-flow to a patched version released after 1.8.4. Check the official Gitee repository (https://gitee.com/dromara/warm-flow/) for the latest stable release. As an immediate workaround pending patching, restrict access to the Workflow Definition Handler (/warm-flow/save-json endpoint) to trusted administrators only, and implement input validation to reject any listenerPath, skipCondition, or permissionFlag parameters containing SpEL syntax characters (${, #{, brackets, operators). Disable or restrict the ability for end-users to define custom workflow expressions if not operationally necessary. Monitor application logs for evidence of exploitation attempts, particularly payloads containing SpEL injection patterns.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the SpelHelper.parseExpression function within the Workflow Definition Handler component of warm-flow, a workflow orchestration framework. The root cause is CWE-94 (Improper Control of Generation of Code), where user-supplied input from listenerPath, skipCondition, or permissionFlag parameters are passed directly to SpEL expression parsing without proper validation or sanitization. SpEL is a powerful expression language used in Spring Framework that allows dynamic evaluation of strings as code. When user input reaches SpEL evaluation functions unfiltered, attackers can craft malicious expressions to break out of intended expression syntax and execute arbitrary Java code with the privileges of the application runtime.
Know when Warm Flow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
6DescriptionCVE.org
A security flaw has been discovered in Dromara warm-flow up to 1.8.4. Impacted is the function SpelHelper.parseExpression of the file /warm-flow/save-json of the component Workflow Definition Handler. The manipulation of the argument listenerPath/skipCondition/permissionFlag results in code injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Blast Radius
ecosystem impact- 17 maven packages depend on org.dromara.warm:warm-flow-plugin-modes-sb (6 direct, 11 indirect)
Ecosystem-wide dependent count for version 1.8.5.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB