Elysia betroffen von willkürlicher Code-Injektion durch Cookie-Konfiguration

The impact of CVE-2025-66457 is significant due to its potential for arbitrary code execution. An attacker gaining write access to either the Elysia application's source code or the cookie configuration file can inject and execute malicious code. This could lead to complete system compromise, including data theft, modification, or deletion. The vulnerability's severity is amplified when combined with GHSA-hxj9-33pp-j2cc, creating a full Remote Code Execution (RCE) chain, allowing for more sophisticated attacks and broader impact. The 'aot enabled' default setting doesn't inherently mitigate the vulnerability; proper sanitization of cookie configurations remains crucial.

Applications built using Elysia framework, particularly those that dynamically configure cookies based on user input or external sources, are at significant risk. Development teams using older versions of Elysia and those with inadequate access controls on their application configuration files are especially vulnerable.

• nodejs / server:

  ps aux | grep elysia
  find / -name 'elysia.config.mjs' -print

• nodejs / server:

  npm list elysia
  npm audit elysia

• generic web: Inspect cookie configuration files for unusual or unexpected code patterns. Review application logs for any errors related to cookie parsing or configuration loading.

1. 2025-12-09Disclosure

   disclosure

1. Reserviert2025-12-01
2. Veröffentlicht2025-12-09
3. Geändert2026-02-04
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-66457 is to immediately upgrade to Elysia version 1.4.18 or later, which includes the necessary sanitization fixes. If upgrading is not immediately feasible, consider restricting write access to the cookie configuration file to only trusted processes. Implement strict input validation and sanitization on all user-supplied data used in cookie configurations. While a WAF or proxy might offer some protection, it's not a substitute for patching the underlying vulnerability. Review and audit all cookie configuration files for any signs of malicious code injection.