Kottster CVE-2025-62713

Exploitation requires the target to be running Kottster in DEVELOPMENT mode (production builds are not affected at all) on an affected version (@kottster/server/@kottster/cli 3.2.0 through 3.3.1), AND the development server must be reachable by the attacker over the network. The chain needs no pre-existing credentials (PR:N) because the initApp action can be re-invoked without an 'already initialized' check, letting the attacker mint a new root account and JWT, after which installPackagesForDataSource passes unescaped arguments to a shell for command injection. Primary limiting factors: the dev-mode requirement and the fact that development instances are normally bound to localhost/trusted networks - the vulnerability is only reachable if that server is exposed to untrusted users or networks (which the vendor's workaround explicitly warns against). No user interaction and no authentication are required once the instance is reachable.

This is a genuine pre-authentication RCE (CWE-78 OS command injection) with full CIA impact (VC:H/VI:H/VA:H), but its real-world priority is sharply constrained by a configuration gate that the raw 7.2 score already reflects. The vendor CVSS 4.0 vector encodes AV:N and PR:N (network-reachable, pre-auth) yet also AT:P (Attack Requirements: Present) and E:U (Exploit maturity: Unproven), which correctly signals that exploitation depends on a specific condition - the instance running in development mode - and that no proven exploit exists. The GHSA advisory and vendor explicitly state production deployments were never affected; the flaw only manifests in @kottster/server/@kottster/cli dev mode. No CISA KEV listing and no EPSS score were provided, and the CVSS exploit-maturity metric is Unproven, so there is no evidence of active or opportunistic exploitation. Net: a high-impact but low-likelihood issue - a real priority only for developers who have exposed a Kottster dev server to an untrusted network. Treat it as 'patch promptly in dev environments, not an emergency internet-wide event.' Note the tension to verify: PR:N implies unauthenticated network reach, but the attacker must be able to reach a development instance, which is normally bound to localhost - the AT:P metric captures this and should be weighed against the PR:N reading.

A developer runs a Kottster instance (3.2.0-3.3.1) in development mode and exposes it beyond localhost (e.g., on a shared LAN, a cloud dev box, or behind a permissive tunnel). An unauthenticated attacker who can reach it replays the initApp action to create a fresh root admin and obtain a JWT, then invokes installPackagesForDataSource with injected shell arguments to run arbitrary OS commands on the developer's host. No public exploit code has been identified (CVSS exploit maturity is Unproven), though the GHSA write-up describes the chain in enough detail to reproduce.