CVE-2025-8022

Rejected reason: Bun Shell does not invoke /bin/sh, or any other interpreter, for template literals created with the $ function. Each ${…} interpolation is treated as a single argument. The security responsibility for this usage pattern lies with the calling application, which must ensure the sanitization and validation of any untrusted arguments before passing them to the executed commands. Therefore, the potential for command injection is not a flaw within Bun itself; rather, it is an argument injection that is contingent on its implementation by the consuming application.

Published

Jul 23, 2025

Last Modified

Aug 11, 2025

Status

Rejected

• CVE-2025-8015The WP Shortcodes Plugin — Shortcodes Ultimate plugin for Wo…6.4
• CVE-2025-8017A vulnerability was found in Tenda AC7 15.03.06.44. It has b…8.8
• CVE-2025-8018A vulnerability was found in code-projects Food Ordering Rev…8.8
• CVE-2025-8019A vulnerability was found in Shenzhen Libituo Technology LBT…8.8
• CVE-2025-8020All versions of the package private-ip are vulnerable to Ser…8.2
• CVE-2025-8021All versions of the package files-bucket-server are vulnerab…7.7
• CVE-2025-8023Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11…4.9
• CVE-2025-8025Missing Authentication for Critical Function, Improper Acces…9.8
• CVE-2025-8027On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the …6.5
• CVE-2025-8028On arm64, a WASM `br_table` instruction with a lot of entrie…9.8
• CVE-2025-8029Thunderbird executed `javascript:` URLs when used in `object…8.1
• CVE-2025-8030Insufficient escaping in the “Copy as cURL” feature could po…8.1