CVE-2025-60889

Critical · CVSS 9.8

StellarGroup HPX — Insecure Deserialization RCE (CWE-502)

CVSS: 9.8; nvd
EPSS: 0.51%; 40th pct
KEV: No
Class: other; CWE-502

Description

Insecure deserialization of untrusted input in StellarGroup HPX 1.11.0 under certain conditions may allow attackers to execute arbitrary code or other unspecified impacts.

Search profile — drives PoC discovery

Symbols HPXStellarGroupdeserializationuntrusted inputarbitrary code execution

Keywords CVE-2025-60889HPX deserializationStellarGroup HPX exploitHPX 1.11.0 RCEHPX insecure deserializationCWE-502 HPXTrebledJ HPX PoC

Versions: 1.11.0

References

https://gist.github.com/TrebledJ/b32fd5c469583493ab50244045c9a6e4
https://gist.github.com/TrebledJ/b32fd5c469583493ab50244045c9a6e4

Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-06T06:30:39.000Z