PT-2025-22412 · Ejson2Env · Ejson2Env

Published 2025-05-21 · Updated 2025-05-26 · CVE-2025-48069

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ejson2env versions prior to 2.0.8

Description The issue is related to inadequate output sanitization in the ejson2env tool, which can lead to command injection. This occurs when variable names or values contain malicious content, resulting in unintended commands being output to stdout. If this output is improperly utilized in further command execution, an attacker could execute arbitrary commands on the host system.

Recommendations For versions prior to 2.0.8, update to version 2.0.8, which sanitizes output during decryption. As a temporary workaround, consider avoiding the use of ejson2env to decrypt untrusted user secrets. Restrict evaluating or executing the direct output from ejson2env without removing nonprintable characters.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-48069

GHSA-2C47-M757-32G6

GO-2025-3702

OPENSUSE-SU-2025:15159-1

Affected Products

Ejson2Env

References · 28

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48069.json · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ejson2env/CVE-2025-48069.yml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-48069 · Security Note
• https://osv.dev/vulnerability/CVE-2025-48069 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15159-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3702 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2c47-m757-32g6 · Vendor Advisory
• https://github.com/Shopify/ejson2env/security/advisories/GHSA-2c47-m757-32g6 · Note
• https://github.com/Shopify/ejson2env/commit/592b3ceea967fee8b064e70983e8cec087b6d840 · Note
• https://github.com/Shopify/ejson2env · Note
• https://twitter.com/VulmonFeeds/status/1925301803739992396 · Twitter Post
• https://suse.com/security/cve/CVE-2025-47284 · Note
• https://suse.com/security/cve/CVE-2025-47291 · Note
• https://twitter.com/CVEnew/status/1925247829578002656 · Twitter Post
• https://suse.com/security/cve/CVE-2025-48069 · Note