CVE-2023-51389: HertzBeat SnakeYAML Deser RCE

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-02-22 · updated 2026-06-17
Weakness: CWE-502

Description

Hertzbeat is a real-time monitoring system. At the interface of `/define/yml`, SnakeYAML is used as a parser to parse yml content, but no security configuration is used, resulting in a YAML deserialization vulnerability. Version 1.4.1 fixes this vulnerability.

Affected products

dromara hertzbeat: before 1.4.1 — fixed in 1.4.1

How to fix

Upgrade to a fixed version: dromara hertzbeat 1.4.1. Check the vendor advisory for mitigations.

References

https://github.com/dromara/hertzbeat/commit/97c3f14446d1c96d1fc993df111684926b6cce17
https://github.com/dromara/hertzbeat/security/advisories/GHSA-rmvr-9p5x-mm96
https://github.com/dromara/hertzbeat/commit/97c3f14446d1c96d1fc993df111684926b6cce17
https://github.com/dromara/hertzbeat/security/advisories/GHSA-rmvr-9p5x-mm96

Get alerted when CVE-2023-51389 or the next vulnerability affects your stack