PT-2024-20850 · Sublime Text · Sublime Text

Ryukrg1 · CVE-2024-25255 · Published 2024-11-11 · Updated 2024-12-24

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sublime Text version 4

Description A command injection issue was found in Sublime Text via the New Build System module. It is noted that multiple third parties report this behavior as intended.

Recommendations For Sublime Text version 4, as a temporary workaround, consider disabling the New Build System module until further clarification or a patch is available. Restrict access to the New Build System module to minimize the risk of exploitation.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2024-25255

Affected Products

Sublime Text

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-25255 · Security Note
• https://t.me/cvenotify/105360 · Telegram Post
• https://forum.sublimetext.com/t/cve-2024-25255-critical/74906/3 · Note
• https://twitter.com/CVEnew/status/1856113439502151693 · Twitter Post
• https://sublimetext.com/docs/build_systems.html#exec-target-options · Note
• https://sublimetext.com/docs/build_systems.html#shell_cmd. · Note
• https://t.me/cvedetector/10552 · Telegram Post
• https://exploitart.ist/exploit/2023/09/17/sublime-text-os-command-injection.html · Note