CVE-2025-66457
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-12-09

Last updated on: 2025-12-17

Assigner: GitHub, Inc.

Description
Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.17 and below are subject to arbitrary code execution from cookie config. When dynamic cookies are enabled (e.g. there an existing cookie schema), the cookie config is injected into the compiled route without first being sanitised. Availability of this exploit is generally low, but when combined with GHSA-hxj9-33pp-j2cc, it allows for a full RCE chain. An attack requires write access to either the Elysia app's source code (in which case the vulnerability is meaningless) or write access to the cookie config (perhaps where it is assumed to be provisioned by the environment). This issue is fixed in version 1.4.18.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-09
Last Modified
2025-12-17
Generated
2026-05-07
AI Q&A
2025-12-09
EPSS Evaluated
2026-05-05
NVD
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
elysiajs elysia to 1.4.18 (inc)
elysia elysia *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability affects the Elysia Typescript framework versions 1.4.17 and below. It allows arbitrary code execution through the cookie configuration when dynamic cookies are enabled. The cookie config is injected into the compiled route without sanitization, which can be exploited if an attacker has write access to the cookie config. However, the exploit's availability is generally low and requires either write access to the app's source code or the cookie config. The issue is fixed in version 1.4.18.


How can this vulnerability impact me? :

If exploited, this vulnerability can lead to arbitrary code execution on the server running the Elysia framework. This could allow an attacker to execute malicious code remotely, potentially compromising the server and any data or services it hosts. However, exploitation requires write access to the source code or cookie config, limiting the risk in many scenarios.


What immediate steps should I take to mitigate this vulnerability?

Upgrade Elysia to version 1.4.18 or later, as this version fixes the vulnerability related to arbitrary code execution from cookie config. Additionally, ensure that write access to the cookie config is properly restricted to prevent unauthorized modifications.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart