Vulnerabilities in pkg:npm/@kottster/server
PACKAGECVE-2025-62713 is a HIGH kottster app reinitialization can be vulnerability (CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')) affecting @kottster/server libraries in the npm ecosystem. The issue involves kottster app reinitialization can be re-triggered allowing command injection in development mode. Remediation is available by upgrading affected packages to version 3.3.2.
pkg:npm/@kottster/server
Vulnerability advisories affecting package pkg:npm/@kottster/server. Select an advisory below to view technical details or fixes.
| Advisory ID | CVE / NVD | Severity | Summary |
|---|---|---|---|
| GHSA-j3w7-9qc3-g96p | CVE-2025-62713 | HIGH | Kottster app reinitialization can be re-triggered allowing command injection in development mode |
CVE-2025-62713 at a Glance
How to Fix CVE-2025-62713
To remediate this vulnerability, upgrade all affected @kottster/server dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install @kottster/server@3.3.2Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls @kottster/serverHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2025-62713, inspect your project dependencies using npm:
npm ls @kottster/serverAnalyze the terminal output to locate any version of @kottster/server in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.3.2), your application is affected.
Note: The npm ls @kottster/server command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), where the product constructs all or part of an os command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended os command when it is sent to a downstream component. In @kottster/server, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2025-62713 Affected @kottster/server Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
@kottster/server
|
npm |
≥ 3.2.0
< 3.3.2
|
3.3.2
|
References
Frequently Asked Questions
What is CVE-2025-62713?
Which @kottster/server versions are affected?
What version fixes CVE-2025-62713?
Is @kottster/server affected?
What CWE is associated with CVE-2025-62713?
How can I check npm dependencies for CVE-2025-62713?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-j3w7-9qc3-g96p",
"modified" : "2025-10-23T20:37:07Z",
"published" : "2025-10-23T16:01:35Z",
"aliases" : [ "CVE-2025-62713" ],
"summary" : "Kottster app reinitialization can be re-triggered allowing command injection in development mode",
"details" : "### Impact\n\n**Development mode only**. Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode.\n\nThe vulnerability combines two issues:\n1. The `initApp` action can be called repeatedly without checking if the app is already initialized, allowing attackers to create a new root admin account and obtain a JWT token\n2. The `installPackagesForDataSource` action uses unescaped command arguments, enabling command injection\n\nAn attacker with access to a locally running development instance can chain these vulnerabilities to:\n- Reinitialize the application and receive a JWT token for a new root account\n- Use this token to authenticate\n- Execute arbitrary system commands through `installPackagesForDataSource`\n\n**Production deployments were never affected.**\n\n### Patches\n\nFixed in [v3.3.2](https://github.com/kottster/kottster/releases/tag/v3.3.2).\n\nSpecifically, `@kottster/server` [v3.3.2](https://www.npmjs.com/package/@kottster/server/v/3.3.2) and `@kottster/cli` [v3.3.2](https://www.npmjs.com/package/@kottster/cli/v/3.3.2) address this vulnerability.\n\nWe recommend developers using earlier versions of `@kottster/server` and `@kottster/cli` update all the core packages to latest release:\n\n```\nnpm install @kottster/common@latest @kottster/cli@latest @kottster/server@latest @kottster/react@latest\n```\n\n### Workarounds\n\n- Do not expose development servers to public networks or untrusted users\n- Use production mode for any deployment accessible from outside trusted environments\n\n### Credit\n\nWe sincerely thank Jeongwon Jo ([@P0cas](https://github.com/P0cas)) from **RedAlert** for discovering and responsibly disclosing this vulnerability.",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "@kottster/server"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "3.2.0"
}, {
"fixed" : "3.3.2"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/kottster/kottster/security/advisories/GHSA-j3w7-9qc3-g96p"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-62713"
}, {
"type" : "WEB",
"url" : "https://github.com/kottster/kottster/commit/0a7d24922a23aac98372155348787670937eef89"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/kottster/kottster"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-284", "CWE-78" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2025-10-23T16:01:35Z",
"nvd_published_at" : "2025-10-23T17:15:40Z"
}
}