Categories
CVE-2025-48069

ejson2env has insufficient input sanitization

Summary

ejson2env has insufficient input sanitization

Original description

The description as published by the source.

ejson2env allows users to decrypt EJSON secrets and export them as environment variables. Prior to version 2.0.8, the ejson2env tool has a vulnerability related to how it writes to stdout. Specifically, the tool is intended to write an export statement for environment variables and their values. However, due to inadequate output sanitization, there is a potential risk where variable names or values may include malicious content, resulting in additional unintended commands being output to stdout. If this output is improperly utilized in further command execution, it could lead to command injection, allowing an attacker to execute arbitrary commands on the host system. Version 2.0.8 sanitizes output during decryption. Other mitigations involve avoiding use of ejson2env to decrypt untrusted user secrets and/or avoiding evaluating or executing the direct output from ejson2env without removing nonprintable characters.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details