{"id":"GHSA-j3w7-9qc3-g96p","revision":"e689cc798b554870bedcde5b13775ddb","records":[{"revision":"e689cc798b554870bedcde5b13775ddb","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-j3w7-9qc3-g96p","aliases":["CVE-2025-62713"],"title":"Kottster app reinitialization can be re-triggered allowing command injection in development mode","description":"### Impact\n\n**Development mode only**. Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode.\n\nThe vulnerability combines two issues:\n1. The `initApp` action can be called repeatedly without checking if the app is already initialized, allowing attackers to create a new root admin account and obtain a JWT token\n2. The `installPackagesForDataSource` action uses unescaped command arguments, enabling command injection\n\nAn attacker with access to a locally running development instance can chain these vulnerabilities to:\n- Reinitialize the application and receive a JWT token for a new root account\n- Use this token to authenticate\n- Execute arbitrary system commands through `installPackagesForDataSource`\n\n**Production deployments were never affected.**\n\n### Patches\n\nFixed in [v3.3.2](https://github.com/kottster/kottster/releases/tag/v3.3.2).\n\nSpecifically, `@kottster/server` [v3.3.2](https://www.npmjs.com/package/@kottster/server/v/3.3.2) and `@kottster/cli` [v3.3.2](https://www.npmjs.com/package/@kottster/cli/v/3.3.2) address this vulnerability.\n\nWe recommend developers using earlier versions of `@kottster/server` and `@kottster/cli` update all the core packages to latest release:\n\n```\nnpm install @kottster/common@latest @kottster/cli@latest @kottster/server@latest @kottster/react@latest\n```\n\n### Workarounds\n\n- Do not expose development servers to public networks or untrusted users\n- Use production mode for any deployment accessible from outside trusted environments\n\n### Credit\n\nWe sincerely thank Jeongwon Jo ([@P0cas](https://github.com/P0cas)) from **RedAlert** for discovering and responsibly disclosing this vulnerability.","state":0,"publishedAt":"2025-10-23T16:01:35+00:00","modifiedAt":"2025-10-23T20:37:07+00:00","affected":[{"ecosystem":"npm","name":"@kottster/server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.2.0"},{"kind":"fixed","version":"3.3.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/kottster/kottster/security/advisories/GHSA-j3w7-9qc3-g96p","https://nvd.nist.gov/vuln/detail/CVE-2025-62713","https://github.com/kottster/kottster/commit/0a7d24922a23aac98372155348787670937eef89","https://github.com/kottster/kottster"],"sourceUrl":"https://github.com/advisories/GHSA-j3w7-9qc3-g96p","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-j3w7-9qc3-g96p","identifiers":["GHSA-j3w7-9qc3-g96p","CVE-2025-62713"]},"retained":false,"historicalAffected":[]}],"coverage":[]}