CVE-2023-51388 is a critical severity (CVSS 9.8) script injection flaw in Apache HertzBeat before 1.4.1. CalculateAlarm.java runs alarm expressions with AviatorEvaluator and no security policy. Upgrade to 1.4.1 or later, and configure AviatorScript security policies as the advisory suggests, since the expression engine can run Java static methods by default.
What's affected
The GitHub advisory lists HertzBeat versions before 1.4.1 as affected and 1.4.1 as patched. The flaw is in CalculateAlarm.java, where AviatorEvaluator executes an expression with no security policy configured. AviatorScript can run any static Java method by default, which makes script injection possible.
The two sources differ on severity. NVD scores it 9.8 (Critical), while the GitHub advisory labels it High. Treat it as critical until you have patched.
CVSS for this entry is 9.8 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
Find the HertzBeat version in the web interface or in the name of the jar or container image you deploy. If you use containers, list the image tag.
docker ps --format '{{.Names}} {{.Image}}'
Anything before 1.4.1 is affected. Also check whether the HertzBeat web port is reachable from outside your network, since the NVD vector needs no privileges.
What to do now
- Find every HertzBeat deployment and its version.
- Upgrade to 1.4.1 or later.
- If you build from source, review how AviatorEvaluator is configured, and disable arbitrary execution of Java static methods through AviatorScript's security policies, as the advisory suggests.
- Restrict network access to the HertzBeat console, and review who can define alarm rules.
- Rotate credentials stored in the monitoring system if you suspect it was reached.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests, and look the entry up in the Safeguard Gold directory to see how it is tracked.
Why it matters
CWE-74 is injection in a general sense. Special elements in input change how a downstream component interprets the data. The fix is to neutralize those elements or to keep untrusted input away from the interpreter.
CWE-74 is injection in a general sense. An expression language with full access to the Java runtime becomes a code execution path whenever untrusted input reaches it. The remedy has two parts: patch, and constrain what the evaluator may call.
Monitoring tools are well connected, with credentials for many systems, so a takeover can spread. The record's KEV flag is false and the advisory does not report exploitation.
This CVE shares its fixed version with CVE-2023-51389, a YAML deserialization flaw, so one upgrade handles both.
The record does not mark this CVE as listed in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports exploitation in the wild.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is it critical or high?
NVD says 9.8 Critical. The GitHub advisory says High. Both name 1.4.1 as the fix.
Is there a mitigation besides upgrading?
The advisory suggests configuring AviatorScript security policies, such as disabling arbitrary execution of Java static methods.
Sources
Last reviewed: 19 October 2026.
