CVE-2025-8022

CVE-2025-8022 · bun vulnerable to OS Command Injection

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

All versions of the package bun are vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the $ shell API due to improper neutralization of user input. An attacker can exploit this by providing specially crafted input that includes command-line arguments or shell metacharacters, leading to unintended command execution.

CVSS 8.8 · Élevée

Publication: 2025-07-23T06:33:50Z
Mise à jour: 2025-07-23T17:42:18.941869Z

Pile logicielle: node

Produits et versions concernés

bun npm
Plages de versions concernées
- SEMVER: ≤ 1.1.39
Aucun correctif publié

Sources originales

https://nvd.nist.gov/vuln/detail/CVE-2025-8022
https://gist.github.com/lirantal/9780d664037f29d5277d7b2bc569d213
https://github.com/oven-sh/bun
https://security.snyk.io/vuln/SNYK-JS-BUN-9510752
https://osv.dev/vulnerability/GHSA-4j66-8f4r-3pjx

Vérifiez votre serveur →

CVE-2025-8022 · bun vulnerable to OS Command Injection

Produits et versions concernés

bun npm

Sources originales