sqls-server/sqls · Security
sqls-server/sqls is vulnerable to command injection in the config command
- GHSA ID
- GHSA-f9f4-5859-29mf
- CVE ID
- CVE-2025-61141
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Description
sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environment variable and config file path to sh -c without sanitization, allowing attackers to execute arbitrary commands.
This issue has been patched via commit https://github.com/sqls-server/sqls/commit/468a23fc89af89f632cc023a10c031e4bc781797.
CWEs
- CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-61141 ↗
- https://advisory.dw1.io/54 ↗
- https://github.com/sqls-server/sqls ↗
- https://lukmanern.github.io/CVE-2025-61141.html ↗
- https://github.com/sqls-server/sqls/commit/468a23fc89af89f632cc023a10c031e4bc781797 ↗
- https://pkg.go.dev/vuln/GO-2025-4088 ↗
- https://github.com/advisories/GHSA-f9f4-5859-29mf ↗