CVE-2025-48069

ejson2env allows users to decrypt EJSON secrets and export them as environment variables. Prior to version 2.0.8, the `ejson2env` tool has a vulnerability related to how it writes to `stdout`. Specifically, the tool is intended to write an export statement for environment variables and their values. However, due to inadequate output sanitization, there is a potential risk where variable names or values may include malicious content, resulting in additional unintended commands being output to `stdout`. If this output is improperly utilized in further command execution, it could lead to command injection, allowing an attacker to execute arbitrary commands on the host system. Version 2.0.8 sanitizes output during decryption. Other mitigations involve avoiding use of `ejson2env` to decrypt untrusted user secrets and/or avoiding evaluating or executing the direct output from `ejson2env` without removing nonprintable characters.

• CWE-78

• https://github.com/Shopify/ejson2env/commit/592b3ceea967fee8b064e70983e8cec087b6d840
• https://github.com/Shopify/ejson2env/security/advisories/GHSA-2c47-m757-32g6

Published

May 21, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-48063XWiki is a generic wiki platform. In XWiki 16.10.0, required…8.8
• CVE-2025-48064GitHub Desktop is an open-source, Electron-based GitHub app …3.3
• CVE-2025-48065Combodo iTop is a web based IT service management tool. Vers…6.1
• CVE-2025-48066wire-webapp is the web application for the open-source messa…5.5
• CVE-2025-48067OctoPrint provides a web interface for controlling consumer …4.6
• CVE-2025-48068Next.js is a React framework for building full-stack web app…4.3
• CVE-2025-4807A vulnerability, which was classified as problematic, was fo…7.5
• CVE-2025-48070Plane is open-source project management software. Versions p…4.3
• CVE-2025-48071OpenEXR provides the specification and reference implementat…7.8
• CVE-2025-48072OpenEXR provides the specification and reference implementat…9.1
• CVE-2025-48073OpenEXR provides the specification and reference implementat…6.2
• CVE-2025-48074OpenEXR provides the specification and reference implementat…5.5