Critical · 9.8 CVE-2023-24162 EUVD-2023-0377GHSA-77h8-5j3h-jcjf

Dromara Hutool Deserialization of Untrusted Data vulnerability

Published Jan 31, 2023 · Updated Mar 27, 2025 · Assigned by mitre

Description

Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameter.

Ecosystem	Package	Affected	Fixed	Record
Maven	cn.hutool:hutool-all	<= 5.8.11	—	GHSA-77h8-5j3h-jcjf