A vulnerability exists in xiandafu beetl through version 3.20.2 that allows an attacker to inject unfiltered expressions into an SpEL function. The improper neutralization of special elements in the expression language can lead to execution of arbitrary code when the expression is evaluated. Publicly available exploits demonstrate that remote exploitation is feasible, and the project has not yet released a fix.

The affected product is xiandafu beetl. Versions up to and including 3.20.2 are vulnerable; the SpELFunction component under beetl-classic-integration/beetl-spring-classic is the point of weakness.

The CVSS score is 6.9, indicating a moderate to high severity. EPSS data are not available, and the vulnerability is not listed in CISA KEV. Because remote exploitation is possible and exploits are publicly available, the risk is significant. The attack likely occurs when an attacker can supply or influence Expression Language statements that invoke SpELFunction.