Dromara warm-flow Workflow Definition save-json SpelHelper.parseExpression code injection
Priority LOW 24CWE-74Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.
Summary
A security flaw has been discovered in Dromara warm-flow up to 1.8.4. Impacted is the function SpelHelper.parseExpression of the file /warm-flow/save-json of the component Workflow Definition Handler. The manipulation of the argument listenerPath/skipCondition/permissionFlag results in code injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00302 23rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed org.dromara.warm:warm-flow-plugin-modes-sb (Maven): 1.8.5
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| dromara | warm-flow | 1.8.0; 1.8.1; 1.8.2; 1.8.3; 1.8.4 | — | No fix listed | CNA |
| — | org.dromara.warm:warm-flow-plugin-modes-sb (Maven) | before 1.8.5 | 1.8.5 | Patch available | GHSA-822v-8w6h-5jxp |
- warm-flow Vendordromara Affected 1.8.0; 1.8.1; 1.8.2; 1.8.3; 1.8.4 Fixed in — No fix listed CNA
- org.dromara.warm:warm-flow-plugin-modes-sb (Maven) Vendor— Affected before 1.8.5 Fixed in 1.8.5 Patch available GHSA-822v-8w6h-5jxp
Remediation
- Fix · GHSA-822v-8w6h-5jxp org.dromara.warm:warm-flow-plugin-modes-sb (Maven) Fixed in 1.8.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-6125
- 2026-10-03 Alias added: GHSA-822v-8w6h-5jxp
References
More dromara vulnerabilities
- TI-2023-28043 HertzBeat AviatorScript Inject RCE CVSS 3.1CRITICAL 9.8
- TI-2023-24001 An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
- TI-2023-15126 Dromara Sureness before v1.0.8 was discovered to use a hardcoded key. CVSS 3.1CRITICAL 9.8
- TI-2025-41084 The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface… CVSS 3.1CRITICAL 9.4
- TI-2026-62126 lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint CVSS 4.0HIGH 8.7
- TI-2023-28044 HertzBeat SnakeYAML Deser RCE CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-6125 · CVE Program
- CVE-2026-6125 · NVD
- FIRST EPSS
- GHSA-822v-8w6h-5jxp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences