{"id":"CVE-2025-62713","aliases":["EUVD-2025-35701","GHSA-j3w7-9qc3-g96p"],"status":"published","title":"Kottster app reinitialization can be re-triggered allowing command injection in development mode","description":"Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode. This affects development mode only, production deployments were never affected. This issue has been fixed in version 3.3.2.","severity":{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00609,"percentile":0.49618,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284","CWE-78"],"published":"2025-10-23T16:01:35Z","modified":"2026-10-28T02:30:40Z","fixes":[{"ecosystem":"npm","package":"@kottster/server","fixed_in":["3.3.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@kottster/server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"3.3.2"}]}]},{"source":"osv","ecosystem":"npm","package":"@kottster/server","ranges":[{"type":"SEMVER","events":[{"introduced":"3.2.0"},{"fixed":"3.3.2"}]}]}],"products":[{"vendor":"kottster","product":"kottster"}],"references":[{"url":"https://github.com/kottster/kottster/security/advisories/GHSA-j3w7-9qc3-g96p","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/kottster/kottster/commit/0a7d24922a23aac98372155348787670937eef89","tags":["x_refsource_MISC","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62713","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j3w7-9qc3-g96p"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62713.json","tags":["advisory"]},{"url":"https://github.com/kottster/kottster","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-62713","title":"Kottster app reinitialization can be re-triggered allowing command injection in development mode","description":"Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode. This affects development mode only, production deployments were never affected. This issue has been fixed in version 3.3.2.","status":"published","published":"2025-10-23T16:15:14.696Z","modified":"2025-10-23T16:40:52.174Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high","assessor":"cna"}],"cwes":["CWE-284","CWE-78"],"updated_at":"2026-11-02T14:32:54.87586Z"}],"euvd":[{"id":"EUVD-2025-35701","description":"Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode. This affects development mode only, production deployments were never affected. This issue has been fixed in version 3.3.2.","status":"published","published":"2025-10-23T16:15:14Z","modified":"2025-10-23T16:40:52Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"}],"updated_at":"2026-11-02T19:49:37.862275Z"}],"ghsa":[{"id":"GHSA-j3w7-9qc3-g96p","title":"Kottster app reinitialization can be re-triggered allowing command injection in development mode","description":"### Impact\n\n**Development mode only**. Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode.\n\nThe vulnerability combines two issues:\n1. The `initApp` action can be called repeatedly without checking if the app is already initialized, allowing attackers to create a new root admin account and obtain a JWT token\n2. The `installPackagesForDataSource` action uses unescaped command arguments, enabling command injection\n\nAn attacker with access to a locally running development instance can chain these vulnerabilities to:\n- Reinitialize the application and receive a JWT token for a new root account\n- Use this token to authenticate\n- Execute arbitrary system commands through `installPackagesForDataSource`\n\n**Production deployments were never affected.**\n\n### Patches\n\nFixed in [v3.3.2](https://github.com/kottster/kottster/releases/tag/v3.3.2).\n\nSpecifically, `@kottster/server` [v3.3.2](https://www.npmjs.com/package/@kottster/server/v/3.3.2) and `@kottster/cli` [v3.3.2](https://www.npmjs.com/package/@kottster/cli/v/3.3.2) address this vulnerability.\n\nWe recommend developers using earlier versions of `@kottster/server` and `@kottster/cli` update all the core packages to latest release:\n\n```\nnpm install @kottster/common@latest @kottster/cli@latest @kottster/server@latest @kottster/react@latest\n```\n\n### Workarounds\n\n- Do not expose development servers to public networks or untrusted users\n- Use production mode for any deployment accessible from outside trusted environments\n\n### Credit\n\nWe sincerely thank Jeongwon Jo ([@P0cas](https://github.com/P0cas)) from **RedAlert** for discovering and responsibly disclosing this vulnerability.","status":"published","published":"2025-10-23T16:01:35Z","modified":"2025-10-23T20:37:08Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"}],"cwes":["CWE-78","CWE-284"],"updated_at":"2026-11-02T14:39:03.380616Z"}],"nvd":[{"id":"CVE-2025-62713","description":"Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode. This affects development mode only, production deployments were never affected. This issue has been fixed in version 3.3.2.","status":"published","published":"2025-10-23T17:15:40.29Z","modified":"2026-10-19T16:10:00.26Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-78","CWE-284"],"updated_at":"2026-11-02T14:11:39.579859Z"}],"osv":[{"id":"CVE-2025-62713","title":"Kottster app reinitialization can be re-triggered allowing command injection in development mode","description":"Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode. This affects development mode only, production deployments were never affected. This issue has been fixed in version 3.3.2.","status":"published","published":"2025-10-23T16:15:14.696Z","modified":"2026-10-28T02:30:40.917351576Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"}],"cwes":["CWE-284","CWE-78"],"updated_at":"2026-11-02T15:44:51.851511Z"},{"id":"GHSA-j3w7-9qc3-g96p","title":"Kottster app reinitialization can be re-triggered allowing command injection in development mode","description":"### Impact\n\n**Development mode only**. Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode.\n\nThe vulnerability combines two issues:\n1. The `initApp` action can be called repeatedly without checking if the app is already initialized, allowing attackers to create a new root admin account and obtain a JWT token\n2. The `installPackagesForDataSource` action uses unescaped command arguments, enabling command injection\n\nAn attacker with access to a locally running development instance can chain these vulnerabilities to:\n- Reinitialize the application and receive a JWT token for a new root account\n- Use this token to authenticate\n- Execute arbitrary system commands through `installPackagesForDataSource`\n\n**Production deployments were never affected.**\n\n### Patches\n\nFixed in [v3.3.2](https://github.com/kottster/kottster/releases/tag/v3.3.2).\n\nSpecifically, `@kottster/server` [v3.3.2](https://www.npmjs.com/package/@kottster/server/v/3.3.2) and `@kottster/cli` [v3.3.2](https://www.npmjs.com/package/@kottster/cli/v/3.3.2) address this vulnerability.\n\nWe recommend developers using earlier versions of `@kottster/server` and `@kottster/cli` update all the core packages to latest release:\n\n```\nnpm install @kottster/common@latest @kottster/cli@latest @kottster/server@latest @kottster/react@latest\n```\n\n### Workarounds\n\n- Do not expose development servers to public networks or untrusted users\n- Use production mode for any deployment accessible from outside trusted environments\n\n### Credit\n\nWe sincerely thank Jeongwon Jo ([@P0cas](https://github.com/P0cas)) from **RedAlert** for discovering and responsibly disclosing this vulnerability.","status":"published","published":"2025-10-23T16:01:35Z","modified":"2025-10-23T20:37:07Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U","level":"high"}],"cwes":["CWE-284","CWE-78"],"updated_at":"2026-11-02T15:46:49.977351Z"}]}}