{"id":"GHSA-j3w7-9qc3-g96p","summary":"Kottster app reinitialization can be re-triggered allowing command injection in development mode","details":"### Impact\n\n**Development mode only**. Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode.\n\nThe vulnerability combines two issues:\n1. The `initApp` action can be called repeatedly without checking if the app is already initialized, allowing attackers to create a new root admin account and obtain a JWT token\n2. The `installPackagesForDataSource` action uses unescaped command arguments, enabling command injection\n\nAn attacker with access to a locally running development instance can chain these vulnerabilities to:\n- Reinitialize the application and receive a JWT token for a new root account\n- Use this token to authenticate\n- Execute arbitrary system commands through `installPackagesForDataSource`\n\n**Production deployments were never affected.**\n\n### Patches\n\nFixed in [v3.3.2](https://github.com/kottster/kottster/releases/tag/v3.3.2).\n\nSpecifically, `@kottster/server` [v3.3.2](https://www.npmjs.com/package/@kottster/server/v/3.3.2) and `@kottster/cli` [v3.3.2](https://www.npmjs.com/package/@kottster/cli/v/3.3.2) address this vulnerability.\n\nWe recommend developers using earlier versions of `@kottster/server` and `@kottster/cli` update all the core packages to latest release:\n\n```\nnpm install @kottster/common@latest @kottster/cli@latest @kottster/server@latest @kottster/react@latest\n```\n\n### Workarounds\n\n- Do not expose development servers to public networks or untrusted users\n- Use production mode for any deployment accessible from outside trusted environments\n\n### Credit\n\nWe sincerely thank Jeongwon Jo ([@P0cas](https://github.com/P0cas)) from **RedAlert** for discovering and responsibly disclosing this vulnerability.","aliases":["CVE-2025-62713"],"modified":"2025-10-23T20:37:07Z","published":"2025-10-23T16:01:35Z","database_specific":{"cwe_ids":["CWE-284","CWE-78"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2025-10-23T16:01:35Z","nvd_published_at":"2025-10-23T17:15:40Z"},"references":[{"type":"WEB","url":"https://github.com/kottster/kottster/security/advisories/GHSA-j3w7-9qc3-g96p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62713"},{"type":"WEB","url":"https://github.com/kottster/kottster/commit/0a7d24922a23aac98372155348787670937eef89"},{"type":"PACKAGE","url":"https://github.com/kottster/kottster"}],"affected":[{"package":{"name":"@kottster/server","ecosystem":"npm","purl":"pkg:npm/%40kottster/server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"3.2.0"},{"fixed":"3.3.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/10/GHSA-j3w7-9qc3-g96p/GHSA-j3w7-9qc3-g96p.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U"}]}