English version →
カテゴリ
CVE-2025-48069

ejson2env has insufficient input sanitization

概要

ejson2env has insufficient input sanitization

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

ejson2env allows users to decrypt EJSON secrets and export them as environment variables. Prior to version 2.0.8, the ejson2env tool has a vulnerability related to how it writes to stdout. Specifically, the tool is intended to write an export statement for environment variables and their values. However, due to inadequate output sanitization, there is a potential risk where variable names or values may include malicious content, resulting in additional unintended commands being output to stdout. If this output is improperly utilized in further command execution, it could lead to command injection, allowing an attacker to execute arbitrary commands on the host system. Version 2.0.8 sanitizes output during decryption. Other mitigations involve avoiding use of ejson2env to decrypt untrusted user secrets and/or avoiding evaluating or executing the direct output from ejson2env without removing nonprintable characters.

出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

参照URL

当サイトでは、アクセス解析と広告の効果測定のために Cookie を使います。株式会社Game のサイト共通の設定です。 詳しく