CVE-2025-64726

{"id": "CVE-2025-64726", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64726", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-13T20:14:35.678135Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.3, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "SocketDev", "product": "firewall-release", "versions": [{"status": "affected", "version": "< 0.15.5"}]}]}], "published": "2025-11-13T20:15:53.247", "references": [{"url": "https://bsky.app/profile/evilpacket.net/post/3m4iylwxtns2t", "source": "security-advisories@github.com"}, {"url": "https://github.com/SocketDev/firewall-release/security/advisories/GHSA-6c5p-vqrh-h6fp", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-15"}, {"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "Socket Firewall is an HTTP/HTTPS proxy server that intercepts package manager requests and enforces security policies by blocking dangerous packages. Socket Firewall binary versions (separate from installers) prior to 0.15.5 are vulnerable to arbitrary code execution when run in untrusted project directories. The vulnerability allows an attacker to execute arbitrary code by placing a malicious `.sfw.config` file in a project directory. When a developer runs Socket Firewall commands (e.g., `sfw npm install`) in that directory, the tool loads the `.sfw.config` file and populates environment variables directly into the Node.js process. An attacker can exploit this by setting `NODE_OPTIONS` with a `--require` directive to execute malicious JavaScript code before Socket Firewall's security controls are initialized, effectively bypassing the tool's malicious package detection. The attack vector is indirect and requires a developer to install dependencies for an untrusted project and execute a command within the context of the untrusted project. The vulnerability has been patched in Socket Firewall version 0.15.5. Users should upgrade to version 0.15.5 or later. The fix isolates configuration file values from subprocess environments. Look at `sfw --version` for version information. If users rely on the recommended installation mechanism (e.g. global installation via `npm install -g sfw`) then no workaround is necessary. This wrapper package automatically ensures that users are running the latest version of Socket Firewall. Users who have manually installed the binary and cannot immediately upgrade should avoid running Socket Firewall in untrusted project directories. Before running Socket Firewall in any new project, inspect `.sfw.config` and `.env.local` files for suspicious `NODE_OPTIONS` or other environment variable definitions that reference local files."}, {"lang": "es", "value": "Socket Firewall es un servidor proxy HTTP/HTTPS que intercepta solicitudes del gestor de paquetes y aplica pol\u00edticas de seguridad bloqueando paquetes peligrosos. Versiones binarias de Socket Firewall (separadas de los instaladores) anteriores a la 0.15.5 son vulnerables a la ejecuci\u00f3n de c\u00f3digo arbitrario cuando se ejecutan en directorios de proyectos no confiables. La vulnerabilidad permite a un atacante ejecutar c\u00f3digo arbitrario colocando un archivo '.sfw.config' malicioso en un directorio de proyecto. Cuando un desarrollador ejecuta comandos de Socket Firewall (por ejemplo, 'sfw npm install') en ese directorio, la herramienta carga el archivo '.sfw.config' y rellena las variables de entorno directamente en el proceso de Node.js. Un atacante puede explotar esto configurando 'NODE_OPTIONS' con una directiva '--require' para ejecutar c\u00f3digo JavaScript malicioso antes de que se inicialicen los controles de seguridad de Socket Firewall, eludiendo eficazmente la detecci\u00f3n de paquetes maliciosos de la herramienta. El vector de ataque es indirecto y requiere que un desarrollador instale dependencias para un proyecto no confiable y ejecute un comando dentro del contexto del proyecto no confiable. La vulnerabilidad ha sido parcheada en la versi\u00f3n 0.15.5 de Socket Firewall. Los usuarios deben actualizar a la versi\u00f3n 0.15.5 o posterior. La correcci\u00f3n a\u00edsla los valores del archivo de configuraci\u00f3n de los entornos de subproceso. Consulte 'sfw --version' para obtener informaci\u00f3n sobre la versi\u00f3n. Si los usuarios conf\u00edan en el mecanismo de instalaci\u00f3n recomendado (por ejemplo, instalaci\u00f3n global a trav\u00e9s de 'npm install -g sfw'), entonces no es necesaria ninguna soluci\u00f3n alternativa. Este paquete envoltorio asegura autom\u00e1ticamente que los usuarios est\u00e9n ejecutando la \u00faltima versi\u00f3n de Socket Firewall. Los usuarios que han instalado manualmente el binario y no pueden actualizar inmediatamente deben evitar ejecutar Socket Firewall en directorios de proyectos no confiables. Antes de ejecutar Socket Firewall en cualquier proyecto nuevo, inspeccione los archivos '.sfw.config' y '.env.local' en busca de 'NODE_OPTIONS' sospechosas u otras definiciones de variables de entorno que hagan referencia a archivos locales."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "security-advisories@github.com"}