6.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-48069

CVE-2025-48069: Insufficient input sanitization in ejson2env

Summary

The ejson2env tool has a vulnerability related to how it writes to stdout. Specifically, the tool is intended to write an export statement for environment variables and their values. However, due to inadequate output sanitization, there is a potential risk where variable names or values may include malicious content, resulting in additional unintended commands being output to stdout. If this output is improperly utilized in further command execution, it could lead to command injection vulnerabilities, allowing an attacker to execute arbitrary commands on the host system.

Details

The vulnerability exists because environment variables are not properly sanitized during the decryption phase, which enables malicious keys or encrypted values to inject commands.

Impact

An attacker with control over .ejson files can inject commands in the environment where source $(ejson2env) or eval ejson2env are executed.

Mitigation

Update to a version of ejson2env that sanitizes the output during decryption or
Do not use ejson2env to decrypt untrusted user secrets or
Do not evaluate or execute the direct output from ejson2env without removing nonprintable characters.

Credit

Thanks to security researcher Demonia for reporting this issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-48069

CVE-2025-48069:

6.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/Shopify/ejson2env/v2	go	< 2.0.8	2.0.8
ejson2env	rubygems	< 2.0.8	2.0.8
github.com/Shopify/ejson2env	go	< 2.0.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis is based on the diff obtained from fetching the content of the commit URL https://github.com/Shopify/ejson2env/commit/592b3ceea967fee8b064e70983e8cec087b6d840, as the get_commit_infos tool did not return structured commit information. The vulnerability lies in insufficient input sanitization of environment variable keys and values, leading to potential command injection when the output of ejson2env is evaluated.

The identified functions (ExportEnv, ExportQuiet, and the internal escape function) were directly involved in processing these keys and values and constructing the output strings in their pre-patch versions.

ExportEnv and ExportQuiet took the map of keys and values, formatted them into strings, and wrote them to the output. Their previous implementations used keys directly in fmt.Sprintf and relied on the escape function for values, followed by regex-based validation (ValidateExportCommand/ValidateQuietCommand) which proved insufficient.
The escape function was responsible for sanitizing the values. Its previous implementation, using unicode.IsControl for filtering and shell.Escape for escaping, was inadequate.

The patch significantly refactored these functions, introduced explicit key validation (validKey), and changed the value sanitization mechanism (filteredValue using a different escaping library), indicating that the prior versions of ExportEnv, ExportQuiet, and escape were the source of the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

6.6

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-48069: Insufficient input sanitization in ejson2env

Summary

Details

Impact

Mitigation

Credit

CVE-2025-48069:

6.6

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

CVE-2025-48069: Insufficient input sanitization in ejson2env

Summary

Details

Impact

Mitigation

Credit

6.6

6.6

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI