What’s Vulnerable › Vulnerabilities

CVE-2023-51388: HertzBeat AviatorScript Inject RCE

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-02-22 · updated 2026-06-17
• Weakness: CWE-74

Description

Hertzbeat is a real-time monitoring system. In `CalculateAlarm.java`, `AviatorEvaluator` is used to directly execute the expression function, and no security policy is configured, resulting in AviatorScript (which can execute any static method by default) script injection. Version 1.4.1 fixes this vulnerability.

Affected products

• dromara hertzbeat: before 1.4.1 — fixed in 1.4.1

How to fix

Upgrade to a fixed version: dromara hertzbeat 1.4.1. Check the vendor advisory for mitigations.

References

• https://github.com/dromara/hertzbeat/commit/8dcf050e27ca95d15460a7ba98a3df8a9cd1d3d2
• https://github.com/dromara/hertzbeat/security/advisories/GHSA-mcqg-gqxr-hqgj
• https://github.com/dromara/hertzbeat/commit/8dcf050e27ca95d15460a7ba98a3df8a9cd1d3d2
• https://github.com/dromara/hertzbeat/security/advisories/GHSA-mcqg-gqxr-hqgj

Get alerted when CVE-2023-51388 or the next vulnerability affects your stack