CVE-2022-25908
Published on: Not Yet Published
Last Modified on: 02/02/2023 06:25:00 PM UTC
Certain versions of Create-choo-electron from Create-choo-electron Project contain the following vulnerability:
All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization.
- CVE-2022-25908 has been assigned by
[email protected] to track the vulnerability - currently rated as CRITICAL severity.
CVSS3 Score: 9.8 - CRITICAL
| Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|---|---|---|---|
| NETWORK | LOW | NONE | NONE |
| Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
| UNCHANGED | HIGH | HIGH | HIGH |
CVE References
| Description | Tags ⓘ | Link |
|---|---|---|
| Command Injection in create-choo-electron | CVE-2022-25908 | Snyk | security.snyk.io text/html |
MISC security.snyk.io/vuln/SNYK-JS-CREATECHOOELECTRON-3157953 |
There are currently no QIDs associated with this CVE
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Create-choo-electron Project | Create-choo-electron | All | All | All | All |
- cpe:2.3:a:create-choo-electron_project:create-choo-electron:*:*:*:*:*:node.js:*:*:
No vendor comments have been submitted for this CVE
Social Mentions
| Source | Title | Posted (UTC) |
|---|---|---|
 @Robo_Alerts |
Potentially Critical CVE Detected! CVE-2022-25908 All versions of the package create-choo-electron are vulnerable t… twitter.com/i/web/status/1… | 2023-01-24 05:55:55 |
| @CVEreport |
CVE-2022-25908 : All versions of the package create-choo-electron are vulnerable to Command Injection via the devIn… twitter.com/i/web/status/1… | 2023-01-26 21:20:15 |