CVE-2025-64726
BaseFortify
Publication date: 2025-11-13
Last updated on: 2025-11-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| socket_firewall | socket_firewall | 0.15.5 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-427 | The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. |
| CWE-15 | One or more system settings or configuration elements can be externally controlled by a user. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
Socket Firewall versions prior to 0.15.5 are vulnerable to arbitrary code execution when run in untrusted project directories. An attacker can place a malicious .sfw.config file in a project directory, which Socket Firewall loads when running commands like 'sfw npm install'. This file can set environment variables such as NODE_OPTIONS with a --require directive to execute malicious JavaScript code before the tool's security controls initialize, bypassing its malicious package detection. The vulnerability requires a developer to run Socket Firewall commands in an untrusted project directory. It has been fixed in version 0.15.5 by isolating configuration file values from subprocess environments.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to execute arbitrary code on your system if you run Socket Firewall commands in an untrusted project directory containing a malicious .sfw.config file. This could lead to compromise of your development environment, bypassing security controls intended to block dangerous packages, potentially resulting in unauthorized access, data theft, or system damage.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
To detect this vulnerability on your system, inspect project directories for the presence of a malicious `.sfw.config` file, especially before running Socket Firewall commands. Check for suspicious environment variable definitions such as `NODE_OPTIONS` that include a `--require` directive referencing local files. You can use commands like `cat .sfw.config` or `grep NODE_OPTIONS .sfw.config .env.local` in project directories to look for suspicious entries. Also, verify the Socket Firewall version by running `sfw --version` to ensure it is 0.15.5 or later.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Socket Firewall to version 0.15.5 or later, which contains the patch for this vulnerability. If upgrading immediately is not possible and you have manually installed the binary, avoid running Socket Firewall in untrusted project directories. Additionally, before running Socket Firewall in any new project, inspect `.sfw.config` and `.env.local` files for suspicious environment variable definitions such as `NODE_OPTIONS` that could execute malicious code.