Elysia affected by arbitrary code injection through cookie configGHSA-8vch-m3f4-q8jf
Fix: elysiajs/elysia#1564GHSA-8vch-m3f4-q8jf is a Code Injection vulnerability in elysia. A fix is available for elysia — see the affected versions and patch details below.
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- A successful exploit gives an attacker total control of the affected component, not partial access.
Exploitation and automatability from CISA’s SSVC triage for GHSA-8vch-m3f4-q8jf.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
elysianpmDescription
Arbitrary code execution from cookie config. If dynamic cookies are enabled (ie there exists a schema for cookies), the cookie config is injected into the compiled route without first being sanitised.
Availability of this exploit is generally low, as it requires write access to either the Elysia app's source code (in which case the vulnerability is meaningless) or write access to the cookie config (perhaps where it is assumed to be provisioned by the environment).
However when combined with GHSA-hxj9-33pp-j2cc, this vulnerability allows for a full RCE chain.
Impact
- aot enabled (default)
- cookie schema passed to route
- Cookie config controllable eg. via env
Example of vulnerable code
new Elysia({
cookie: {
secrets: `' + console.log('pwned from secrets') + '`
},
})
.get("/", () => "hello world", {
cookie: t.Cookie({
foo: t.Any(),
}),
})
POC: https://github.com/sportshead/elysia-poc
Patches
Patched by 1.4.17 (https://github.com/elysiajs/elysia/pull/1564)
Reference commit:
- https://github.com/elysiajs/elysia/pull/1564/commits/26935bf76ebc43b4a43d48b173fc853de43bb51e
- https://github.com/elysiajs/elysia/pull/1564/commits/3af978663e437dccc6c1a2a3aff4b74e1574849e
Workarounds
Sanitize cookie-related env input
const overrideUnsafeQuote = (value: string) =>
// '`' + value + '`'
'`' + value.replace(/'/g, '\\`').replace(/\${/g, '$\\{') + '`'
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | elysia | all versions | 1.4.18npm install elysia@1.4.18 |
Affected Products
elysiaelysiajsDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for elysia, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update elysia to 1.4.18 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-8vch-m3f4-q8jf is resolved across your whole dependency graph.
Workarounds
Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does.
Frequently Asked Questions
Is GHSA-8vch-m3f4-q8jf in your dependencies?
Find it across npm, including transitive dependencies.