Read the docs
TI-2025-30440 Aliases CVE-2025-48069GHSA-2c47-m757-32g6

ejson2env has insufficient input sanitization

Priority LOW 34CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

ejson2env allows users to decrypt EJSON secrets and export them as environment variables. Prior to version 2.0.8, the `ejson2env` tool has a vulnerability related to how it writes to `stdout`. Specifically, the tool is intended to write an export statement for environment variables and their values. However, due to inadequate output sanitization, there is a potential risk where variable names or values may include malicious content, resulting in additional unintended commands being output to `stdout`. If this output is improperly utilized in further command execution, it could lead to command injection, allowing an attacker to execute arbitrary commands on the host system. Version 2.0.8 sanitizes output during decryption. Other mitigations involve avoiding use of `ejson2env` to decrypt untrusted user secrets and/or avoiding evaluating or executing the direct output from `ejson2env` without removing nonprintable characters.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01424 73rd percentileScored 2026-11-07
Fix Fixed ejson2env (Shopify): 2.0.8github.com/Shopify/ejson2env/v2 (Go): 2.0.8+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
remix-runejson2envbefore 2.0.82.0.8Patch availableCNA
—github.com/Shopify/ejson2env/v2 (Go)before 2.0.82.0.8Patch availableGHSA-2c47-m757-32g6
—ejson2env (RubyGems)before 2.0.82.0.8Patch availableGHSA-2c47-m757-32g6
—github.com/Shopify/ejson2env (Go)all versions—No fix listedGHSA-2c47-m757-32g6
  • ejson2env Vendorremix-run Affected before 2.0.8 Fixed in 2.0.8 Patch available CNA
  • github.com/Shopify/ejson2env/v2 (Go) Vendor— Affected before 2.0.8 Fixed in 2.0.8 Patch available GHSA-2c47-m757-32g6
  • ejson2env (RubyGems) Vendor— Affected before 2.0.8 Fixed in 2.0.8 Patch available GHSA-2c47-m757-32g6
  • github.com/Shopify/ejson2env (Go) Vendor— Affected all versions Fixed in — No fix listed GHSA-2c47-m757-32g6

Remediation

  • Fix · CNA ejson2env (Shopify) Fixed in 2.0.8
  • Fix · GHSA-2c47-m757-32g6 github.com/Shopify/ejson2env/v2 (Go) Fixed in 2.0.8 Advisory →
  • Fix · GHSA-2c47-m757-32g6 ejson2env (RubyGems) Fixed in 2.0.8 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-48069
  2. 2026-10-03 Alias added: GHSA-2c47-m757-32g6

References

Advisory 1

Other 4

  • TI-2025-28449 React Router allows pre-render data spoofing on React-Router framework mode CVSS 3.1HIGH 8.2
  • TI-2025-28448 React Router allows a DoS via cache poisoning by forcing SPA mode CVSS 3.1HIGH 7.5
  • TI-2025-38117 React Router has Path Traversal in File Session Storage CVSS 3.1CRITICAL 9.1
  • TI-2026-40200 React Router: Unauthenticated Denial of Service via Inefficient Route Matching CVSS 4.0HIGH 8.7
  • TI-2025-33550 Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class CVSS 4.0HIGH 8.1
  • TI-2026-26385 Ruby LSP has arbitrary code execution through branch setting CVSS 4.0HIGH 7.1
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences