CVE-2025-29085

CVE-2025-29085 is a critical SQL injection flaw (CWE-89) in the Vipshop Saturn job-scheduling console, versions 3.5.1 and earlier. A remote, unauthenticated attacker can trigger it by sending crafted input to the zkClusterKey parameter of the /console/dashboard/executorCount endpoint, and per the advisory the injected SQL can escalate to arbitrary code execution. Successful exploitation gives the attacker full confidentiality, integrity, and availability impact on the host running the affected console, consistent with the 9.8 CVSS score. All Saturn deployments running version 3.5.1 or earlier are affected. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, and it is not in CISA KEV, but the EPSS score of 30.7% (98th percentile) indicates a high predicted likelihood of exploitation within the next 30 days.

What to do: Upgrade Saturn to a release newer than v3.5.1 as soon as the vendor publishes a patched version, and verify your deployed version via the console or deployment manifests. Until patching, restrict network access to the Saturn console (especially /console/dashboard/* endpoints) to trusted users and place a WAF or input validation in front of the zkClusterKey parameter. Monitor access and database logs for anomalous queries or unexpected commands originating from the executorCount endpoint, and watch for a public PoC given the elevated EPSS score.