CVE-2022-25908 | CVE Tracker

Description

All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization.

Scores

CVSS scores of CVE-2022-25908, by who scored it
Scored by	CVSS	Score	Vector
snykCNA (assigner)	3.1	High7.4	CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
NVDNVD · Modified	3.1	Critical9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 1.6% · top 25% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.4.

Weakness

CWE-78: Command Injection (opens in a new tab)All about CWE-78 and its CVEs
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') (opens in a new tab)All about CWE-77 and its CVEs

Affected products

create-choo-electron
- affected < *

Affected packages

From reviewed advisories of the GitHub Advisory Database.

npmcreate-choo-electronGHSA-j8wr-fwf2-vvr9 (opens in a new tab)

References (1)

https://security.snyk.io/vuln/SNYK-JS-CREATECHOOELECTRON-3157953 (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-25908](https://trackcve.app/badge/CVE-2022-25908.svg)](https://trackcve.app/cve/CVE-2022-25908)

Record last updated 1 Apr 2025, 15:30 UTC.

All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper…