CVE-2026-88616 in RuoYi-Vue-Plus
Summary
by MITRE • 09/15/2026
An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process, Warm-Flow TaskService.skip, POST /workflow/task/completeTask components
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in RuoYi-Vue-Plus version 6.0.0 represents a critical server-side code injection flaw within the workflow management subsystem. This security defect is primarily located in the FlwTaskController.java component, specifically affecting endpoints such as POST /workflow/task/completeTask. The root cause lies in the improper handling of user-supplied input by downstream service implementations, including FlwTaskServiceImpl.completeTask and CompleteExecuteComponent.process, as well as the task skipping logic within Warm-Flow TaskService.skip. Because RuoYi-Vue-Plus is a widely used rapid development platform based on Spring Boot and Vue.js, this vulnerability poses a significant risk to organizations relying on its default configurations for business process automation. The flaw allows an unauthenticated or authenticated remote attacker to inject malicious code that gets executed within the server environment, effectively granting full control over the underlying operating system depending on the privileges of the application process.
From a technical perspective, the exploitation mechanism typically involves manipulating parameters passed during task completion or skipping operations. In many Java-based workflow engines, dynamic execution features may allow for script evaluation or method invocation based on input data. If these inputs are not strictly validated against a whitelist of allowed values or if they are directly concatenated into executable strings without proper sanitization, an attacker can craft payloads that bypass intended logic flows. The involvement of CompleteExecuteComponent.process suggests that the vulnerability might be triggered during the execution phase of workflow tasks where business rules or scripts are evaluated. Similarly, the TaskService.skip method indicates that even administrative actions like skipping a task step can be abused to trigger arbitrary code execution if input validation is insufficient. This aligns with CWE-94, which describes Improper Control of Generation of Code (Code Injection), and specifically relates to CWE-502, Deserialization of Untrusted Data, if the injection vector involves deserializing malicious objects that lead to gadget chain exploitation within the Java ecosystem.
The operational impact of this vulnerability is severe, as it enables Remote Code Execution (RCE). An attacker who successfully exploits this flaw can execute arbitrary commands on the server hosting the RuoYi-Vue-Plus application. This could lead to a complete compromise of the system, including theft of sensitive data stored in associated databases, modification or deletion of critical business records, and use of the compromised host as a pivot point for further attacks within the internal network. In cloud environments, this might also allow lateral movement if instance metadata services are accessible from the application context. The presence of this flaw undermines the integrity and availability guarantees provided by the workflow engine, potentially causing service disruptions or data corruption depending on the nature of the executed commands.
Mitigation strategies should focus on immediate remediation through software updates and defensive coding practices. Users running RuoYi-Vue-Plus 6.0.0 must upgrade to a patched version where input validation has been strengthened in the FlwTaskController, FlwTaskServiceImpl, CompleteExecuteComponent, and Warm-Flow TaskService components. Developers should implement strict allow-listing for any dynamic execution features, ensuring that only predefined, safe values are processed by workflow engines. Input sanitization must be applied at all entry points, particularly on POST endpoints handling task states. Additionally, deploying a Web Application Firewall (WAF) with rules tuned to detect code injection patterns can provide an additional layer of defense while patches are being deployed. Monitoring server logs for unusual process executions or unexpected network connections originating from the application server is also recommended to detect potential exploitation attempts in real-time according to MITRE ATT&CK technique T1059, Command and Scripting Interpreter.