PT-2025-46904 · Unknown · Socket Firewall

Published 2025-11-13 · Updated 2025-11-14 · CVE-2025-64726

Positive Technologies (AI Summary)

CVSS v4.0

7.3

High

Base vector

AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Socket Firewall versions prior to 0.15.5

Description Socket Firewall is an HTTP/HTTPS proxy server designed to enforce security policies by blocking dangerous packages. Versions of Socket Firewall prior to 0.15.5 are susceptible to arbitrary code execution when operating within untrusted project directories. An attacker can leverage this by placing a malicious .sfw.config file in a project directory. When a developer executes Socket Firewall commands, such as sfw npm install, within that directory, the tool loads the .sfw.config file and incorporates environment variables directly into the Node.js process. This allows an attacker to exploit the system by setting the NODE OPTIONS environment variable with a --require directive, enabling the execution of malicious JavaScript code before Socket Firewall’s security measures are activated, effectively circumventing malicious package detection. The attack requires a developer to install dependencies for an untrusted project and then execute a command within that project’s context. The vulnerable component is the loading and processing of the .sfw.config file, specifically how it populates environment variables. The vulnerable parameter is NODE OPTIONS.

Recommendations Upgrade to Socket Firewall version 0.15.5 or later. If unable to upgrade, avoid running Socket Firewall in untrusted project directories. Inspect .sfw.config and .env.local files for suspicious NODE OPTIONS or other environment variable definitions that reference local files before running Socket Firewall in any new project.

Exploit

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-15

CWE-427

Related Identifiers

CVE-2025-64726

GHSA-6C5P-VQRH-H6FP

Affected Products

Socket Firewall

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64726.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-64726 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64726 · Vendor Advisory
• https://github.com/SocketDev/firewall-release/security/advisories/GHSA-6c5p-vqrh-h6fp · Note
• https://bsky.app/profile/evilpacket.net/post/3m4iylwxtns2t · Note
• https://twitter.com/VulmonFeeds/status/1989222777799254520 · Twitter Post
• https://t.me/CVEtracker/37282 · Telegram Post