AIKIDO-2026-10921
hutool-core is vulnerable to Remote Code Execution (RCE)
98
Critical Risk
This Affects:
hutool-coreTL;DR
Hutool’s ExpressionEngine interface defines the allowClassSet parameter, which restricts the Java classes accessible during expression evaluation. However, the built-in engines — SpELEngine, MvelEngine, and RhinoEngine — do not enforce this, allowing unrestricted access and potentially leading to remote code execution (RCE). Additionally, with an empty whitelist, ValidateObjectInputStream allows all classes under the java.* package, and JNDIUtil.createInitialContext() does not restrict JNDI URL protocols or remote class loading.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and if you are using ValidateObjectInputStream or JNDIUtil.createInitialContext methods.
Background info
hutool-core is vulnerable to Remote Code Execution (RCE) in versions 0.0.1 - 5.8.45.
How to fix this
Upgrade the cn.hutool:hutool-core library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.