PT-2025-50228 · Elysia · Elysia

Sportshead · Published 2025-12-09 · Updated 2025-12-17 · CVE-2025-66457

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Elysia versions 1.4.17 and below

Description Elysia is a Typescript framework used for request validation, type inference, OpenAPI documentation, and client-server communication. Versions 1.4.17 and below are susceptible to arbitrary code execution originating from cookie configurations. When dynamic cookies are enabled, the cookie configuration is integrated into the compiled route without proper sanitization. The exploit's availability is generally limited, but when combined with GHSA-hxj9-33pp-j2cc, it can lead to a complete remote code execution chain. Successful exploitation requires write access to either the Elysia application's source code or the cookie configuration.

Recommendations Update to version 1.4.18 or later.

Exploit

Fix

RCE

Prototype Pollution

Code Injection

Weakness Enumeration

CWE-1321

CWE-94

Related Identifiers

CVE-2025-66457

GHSA-8VCH-M3F4-Q8JF

GHSA-HXJ9-33PP-J2CC

Affected Products

Elysia

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66457.json · Exploit
• 🔥 https://github.com/sportshead/elysia-poc · Exploit
• https://github.com/elysiajs/elysia/commit/26935bf76ebc43b4a43d48b173fc853de43bb51e · Patch
• https://github.com/elysiajs/elysia/security/advisories/GHSA-8vch-m3f4-q8jf · Vendor Advisory
• https://github.com/elysiajs/elysia/commit/3af978663e437dccc6c1a2a3aff4b74e1574849e · Patch
• https://github.com/elysiajs/elysia/pull/1564 · Patch
• https://osv.dev/vulnerability/GHSA-hxj9-33pp-j2cc · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8vch-m3f4-q8jf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66456 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66457 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66457 · Security Note
• https://github.com/elysiajs/elysia · Note
• https://github.com/elysiajs/elysia/security/advisories/GHSA-hxj9-33pp-j2cc · Note
• https://t.me/cveNotify/146089 · Telegram Post
• https://twitter.com/CVEnew/status/1998732821586915526 · Twitter Post