What is the CVSS score of CVE-2025-63706?

CVE-2025-63706 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of next-npm-version are affected by CVE-2025-63706?

The npm package next-npm-version (v1.0.1) contains a critical code injection vulnerability enabling arbitrary command execution in development and CI/CD environments.

How to fix or mitigate CVE-2025-63706?

Within 24 hours: Audit your dependency manifests (package.json, package-lock.json, yarn.lock, pnpm-lock.yaml) and CI/CD configurations for next-npm-version usage across all projects and pipelines; if found, immediately uninstall or isolate affected systems from network access. Within 7 days: Replace next-npm-version with alternative versioning tools (e.g., standard-version, semantic-release, or native npm version command); if replacement is not immediately feasible, implement strict input validation whitelisting version string patterns and sandbox execution to isolated build environments without network access. Within 30 days: Establish continuous monitoring of the @jswork vendor namespace and npm registry for security patches; implement automated software composition analysis (SCA) tooling to detect similar high-risk packages in your dependency graph; update your dependency governance policy to flag single-author or low-adoption packages for review.

next-npm-version CVE-2025-63706

EUVD-2025-209724 CRITICAL

Code Injection (CWE-94)

2026-05-07 mitre

GHSA-2xx6-qf7x-grqh

RCE Command Injection Node.js Code Injection N A

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.3 HIGH

Command runs in a local developer/CI context requiring the tool be invoked (UI:R) with some access to influence input (PR:L, AV:L); successful injection yields full code execution, so C/I/A:H.

3.1 AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:01 vuln.today

CVSS changed

May 08, 2026 - 23:22 NVD

9.8 (None) 9.8 (CRITICAL)

CVE Published

May 07, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

CVE Published

May 07, 2026 - 00:00 nvd

CRITICAL 9.8

DescriptionCVE.org

NPM package next-npm-version1.0.1 is vulnerable to Command injection.

AnalysisAI

Code injection in the Node.js npm package next-npm-version 1.0.1 (published by afeiship/@jswork) allows attacker-controlled input to be passed into a shell execution context, achieving arbitrary command execution (CWE-94). A proof-of-concept exists in a public gist, though there is no evidence of active exploitation; the EPSS probability is very low (0.03%, 10th percentile) and CISA SSVC rates exploitation as 'none' but automatable with total technical impact. The NVD CVSS of 9.8 (AV:N) appears optimistic for a version-bumping developer utility whose command execution is far more plausibly reached via local/library invocation than remote network access.

Technical ContextAI

next-npm-version is a small helper library in the @jswork/afeiship JavaScript ecosystem intended to automate bumping and publishing npm package versions. Such tooling typically shells out to the npm CLI or git using child_process (exec/execSync) with interpolated arguments; when a version string or other parameter is concatenated into that command line without sanitization, shell metacharacters (;, |, `, $()) break out of the intended command - the CWE-94 (Improper Control of Generation of Code / code injection) root cause here manifesting as OS command injection. The CPE data is unusable (cpe:2.3:a:n/a:n/a:*) as MITRE recorded the vendor/product as 'n/a', so the affected component is identified only by the package name and the referenced npm/GitHub artifacts.

RemediationAI

No vendor-released patched version is identified at time of analysis - the references point to a GitHub issue (github.com/afeiship/next-npm-version/issues/1) and the npm package page rather than a tagged fixed release, so upgrading is not currently an option. As the most effective compensating control, remove the next-npm-version dependency from build and release pipelines (its function, bumping npm versions, is replaceable by 'npm version' directly), which eliminates the injection surface entirely with no security downside. If it must remain, never pass untrusted or externally-influenced strings (branch names, tags, CI variables, user input) into its version/command parameters, and run any release tooling that uses it in an isolated, least-privileged CI runner so that a triggered command cannot reach production credentials or hosts. Monitor the npm advisory (https://www.npmjs.com/package/@jswork/next-npm-version) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2025-63706) for a fixed release.