{"id":"CVE-2025-62713","aliases":["GHSA-j3w7-9qc3-g96p"],"url":"https://o3.security/vulnerability/CVE-2025-62713","summary":"Kottster app reinitialization can be re-triggered allowing command injection in development mode","details":"### Impact\n\n**Development mode only**. Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode.\n\nThe vulnerability combines two issues:\n1. The `initApp` action can be called repeatedly without checking if the app is already initialized, allowing attackers to create a new root admin account and obtain a JWT token\n2. The `installPackagesForDataSource` action uses unescaped command arguments, enabling command injection\n\nAn attacker with access to a locally running development instance can chain these vulnerabilities to:\n- Reinitialize the application and receive a JWT token for a new root account\n- Use this token to authenticate\n- Execute arbitrary system commands through `installPackagesForDataSource`\n\n**Production deployments were never affected.**\n\n### Patches\n\nFixed in [v3.3.2](https://github.com/kottster/kottster/releases/tag/v3.3.2).\n\nSpecifically, `@kottster/server` [v3.3.2](https://www.npmjs.com/package/@kottster/server/v/3.3.2) and `@kottster/cli` [v3.3.2](https://www.npmjs.com/package/@kottster/cli/v/3.3.2) address this vulnerability.\n\nWe recommend developers using earlier versions of `@kottster/server` and `@kottster/cli` update all the core packages to latest release:\n\n```\nnpm install @kottster/common@latest @kottster/cli@latest @kottster/server@latest @kottster/react@latest\n```\n\n### Workarounds\n\n- Do not expose development servers to public networks or untrusted users\n- Use production mode for any deployment accessible from outside trusted environments\n\n### Credit\n\nWe sincerely thank Jeongwon Jo ([@P0cas](https://github.com/P0cas)) from **RedAlert** for discovering and responsibly disclosing this vulnerability.","published":"2025-10-23T16:15:14.696Z","modified":"2026-08-12T03:51:11.122223450Z","cvss":null,"epss":{"score":0.00739,"percentile":0.51804,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@kottster/server","fixedVersion":"3.3.2"}],"fix":{"url":"https://github.com/kottster/kottster/commit/0a7d24922a23aac98372155348787670937eef89","label":"kottster/kottster@0a7d249"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62713.json"},{"type":"ADVISORY","url":"https://github.com/kottster/kottster/security/advisories/GHSA-j3w7-9qc3-g96p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62713"},{"type":"FIX","url":"https://github.com/kottster/kottster/commit/0a7d24922a23aac98372155348787670937eef89"},{"type":"PACKAGE","url":"https://github.com/kottster/kottster"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:11.122223450Z"}}