A code injection vulnerability exists in the Quartz Job Handler of RuoYi versions up to 4.8.2, allowing attackers to execute arbitrary code by manipulating the invokeTarget argument in the /monitor/job/ endpoint. The flaw stems from insufficient input validation (CWE‑74 and CWE‑94) and can lead to remote code execution, compromising confidentiality, integrity, and availability of the affected system.

The vulnerability affects the yangzongzhuan RuoYi platform in all editions that include the Quartz Job Handler and are running version 4.8.2 or earlier.

The CVSS score of 5.1 indicates moderate severity, and the absence of an EPSS score or KEV listing suggests the exploit activity is not yet widespread, but because the attack can be performed remotely and the code injection can achieve full control, the risk remains significant. Exploitability requires access to the /monitor/job/ endpoint, and the attacker can supply a crafted invokeTarget value to execute arbitrary code. Based on the description, the likely attack vector is through the web interface or API call exposed by the application, and the presence of public exploit code indicates readiness for deployment once the system is identified.