PT-2025-44455 · Unknown · Sqls-Server/Sqls

Published 2025-10-30 · Updated 2025-11-07 · CVE-2025-61141

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions sqls-server/sqls version 0.2.28

Description sqls-server/sqls version 0.2.28 contains a command injection issue in the config command. The openEditor function passes the EDITOR environment variable and the config file path to sh -c without proper sanitization, potentially allowing attackers to execute arbitrary commands. The vulnerable component is the openEditor function. The EDITOR environment variable and the config file path are passed as arguments to the sh -c command.

Recommendations Update to a newer version of sqls-server/sqls that addresses this issue. As a temporary workaround, consider restricting or disabling the use of the config command until a patch is available.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-61141

GHSA-F9F4-5859-29MF

GO-2025-4088

OPENSUSE-SU-2025:15710-1

Affected Products

Sqls-Server/Sqls

References · 88

• https://osv.dev/vulnerability/CVE-2025-61141 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f9f4-5859-29mf · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15710-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61141 · Security Note
• https://osv.dev/vulnerability/GO-2025-4088 · Vendor Advisory
• https://github.com/sqls-server/sqls · Note
• https://github.com/sqls-server/sqls/commit/468a23fc89af89f632cc023a10c031e4bc781797 · Note
• https://suse.com/security/cve/CVE-2025-58073 · Note
• https://suse.com/security/cve/CVE-2016-11067 · Note
• https://reddit.com/r/VulnMatter/comments/1ol36t3/resumen_diario_de_vulnerabilidades_31102025 · Reddit Post
• https://suse.com/security/cve/CVE-2016-11078 · Note
• https://suse.com/security/cve/CVE-2025-59043 · Note
• https://suse.com/security/cve/CVE-2025-11375 · Note
• https://suse.com/security/cve/CVE-2025-54471 · Note
• https://suse.com/security/cve/CVE-2016-11077 · Note