This vulnerability in Dromara warm-flow (<=1.8.4) involves code injection via the SpelHelper.parseExpression function in the Workflow Definition Handler component. By manipulating certain input parameters (listenerPath, skipCondition, permissionFlag) in the /warm-flow/save-json endpoint, an attacker can inject malicious code remotely. The CVSS 4.0 base score is 5.3, indicating medium severity, with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No official fix or patch has been documented in the vendor advisory or patch links.

Successful exploitation allows remote code injection, potentially enabling attackers to execute arbitrary code within the context of the affected application. This could lead to unauthorized actions or compromise of the system running warm-flow. The medium CVSS score reflects moderate impact due to the ease of attack and lack of required privileges, but with limited scope or impact severity as per available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the /warm-flow/save-json endpoint and validate or sanitize inputs for listenerPath, skipCondition, and permissionFlag parameters to reduce risk. Monitor official Dromara channels for updates and apply patches promptly once available.