The vulnerability resides in Baomidou dynamic-datasource 2.5.0, specifically within the DsSpelExpressionProcessor#doDetermineDatasource method that utilizes Spring’s StandardEvaluationContext and SpelExpressionParser. An attacker who can supply a crafted SpEL expression can cause that expression to be evaluated by the application’s context, leading to an injection flaw that may allow arbitrary code execution or other unintended behavior. The flaw exists because user-controlled data can be injected into a SpEL expression without proper validation or sandboxing.

Systems that include Baomidou dynamic-datasource library version 2.5.0 are affected. This includes projects that use the dynamic-datasource-spring component and rely on the SpelExpressionParser for determining data sources at runtime.

The CVSS score of 5.3 marks the issue as moderate in severity, while the EPSS score of less than 1% indicates a low probability of exploitation at this time. The flaw is listed as not appearing in CISA’s KEV catalog. The attack vector is remote, with an attacker able to inject malicious expressions over the network if the application exposes the relevant API endpoints. Once injected, a SpEL expression can execute code within the permissions of the Java process, thereby creating a significant risk if the application runs with elevated privileges.