medium6.6

CVE-2025-48069

Insufficient input sanitization in ejson2env

Impact

### Summary The `ejson2env` tool has a vulnerability related to how it writes to `stdout`. Specifically, the tool is intended to write an export statement for environment variables and their values. However, due to inadequate output sanitization, there is a potential risk where variable names or values may include malicious content, resulting in additional unintended commands being output to `stdout`. If this output is improperly utilized in further command execution, it could lead to command injection vulnerabilities, allowing an attacker to execute arbitrary commands on the host system. ### Details The vulnerability exists because environment variables are not properly sanitized during the decryption phase, which enables malicious keys or encrypted values to inject commands. ### Impact An attacker with control over `.ejson` files can inject commands in the environment where `source $(ejson2env)` or `eval ejson2env` are executed. ### Mitigation - Update to a version of `ejson2env` that sanitizes the output during decryption or - Do not use `ejson2env` to decrypt untrusted user secrets or - Do not evaluate or execute the direct output from `ejson2env` without removing nonprintable characters. ### Credit Thanks to security researcher [Demonia](https://hackerone.com/demonia?type=user) for reporting this issue.

Affected packages

Ecosystem	Package	Affected	Fixed in
go	`github.com/Shopify/ejson2env/v2`	< 2.0.8	2.0.8
rubygems	`ejson2env`	< 2.0.8	2.0.8
go	`github.com/Shopify/ejson2env`	< 2.0.8	none recorded

Weakness classification

CWE-78

Impact

Affected packages

Weakness classification

References