AIKIDO-2026-10097

TL;DR

Affected versions of this package contain a server expression language (SpEL) injection issue in the FeiShuNotifier component, where a user-controlled notification message template is parsed and evaluated with an overly permissive evaluation context. An attacker who can modify the Admin Server’s external configuration (for example via config files, environment variables, or a remote config server) can inject arbitrary SpEL expressions that are later evaluated at runtime, leading to remote code execution, full access to process memory and secrets, and potential denial of service on the Spring Boot Admin Server. Updating to a version that applies the fix (where FeiShuNotifier uses a safer expression evaluation mechanism) is recommended.