An attacker who can send crafted Hessian payloads to the xxl-rpc Listener in alldatacenter alldata may trigger deserialization of untrusted data in the Hessian2Input.readObject method. Because deserialization logic is applied to externally supplied input without validation, an attacker could inject malicious objects that are instantiated during deserialization, potentially leading to remote code execution. The flaw aligns with CWE-502 (Deserialization of Untrusted Data) and CWE-20 (Improper Input Validation).

The vulnerability exists in all releases of alldata v0.6.8 and earlier. The affected component is the HessianSerializer in the xxl-rpc Listener module. Any environment running these versions is susceptible, particularly systems that expose the RPC service over a network.

The CVSS base score is 6.9, indicating a moderate risk. The EPSS score is not available, but the vulnerability is publicly known and the issue was described as "not planned" to fix, implying attackers could already craft exploits. Although the vulnerability is not in the KEV catalog, the remote attack vector allows adversaries to target exposed RPC endpoints, potentially compromising affected infrastructure. Prioritizing a patch or mitigating network exposure is advisable.