Elysia CVE-2025-66457

Requires ALL of: (1) AOT/ahead-of-time compilation enabled, which is the default; (2) a cookie schema defined on a route (i.e. 'dynamic cookies' enabled, e.g. via t.Cookie({...})); and (3) attacker-controllable cookie config - specifically the cookie secrets, domain, or related fields, such as when these are provisioned from environment variables the attacker can set. The primary limiting factor is that the attacker must have write access to the cookie config or source code; if they can write source code the flaw is moot, so realistic risk exists only where config is externally provisioned (env injection) and untrusted. Impact escalates to a full unauthenticated RCE chain only when combined with prototype-pollution GHSA-hxj9-33pp-j2cc. Affected: elysiajs/elysia versions 1.4.17 and below on Node.js/Bun.

This is a genuine but conditional RCE (CWE-94 code injection) whose real-world priority is LOW-to-MODERATE despite the 7.5 CVSS 4.0 score. The strongest signal against high priority is the privilege requirement: the vendor's own advisory and CVSS vector both indicate PR:H and attack requirements (AT:P) - exploitation needs write access to the cookie config, which the advisory concedes is 'generally low' availability because an attacker with write access to source code already has full control. EPSS is low at 0.81% (56th percentile), consistent with a config-dependent flaw that is not mass-scannable, so it is unlikely to be opportunistically exploited at scale. KEV status is NO - not listed by CISA, so there is no confirmed active exploitation. A public POC exists (sportshead/elysia-poc) and a test case in the patch demonstrates the injection, so proof of exploitability is confirmed, but POC availability is distinct from active exploitation and should not be conflated. The CVSS vector marks AV:N, yet the description and advisory make clear the true injection surface is the cookie config (e.g. provisioned via environment variables), i.e. local/config control rather than a remote network payload - verify deployment model, as AV:N overstates remote reachability for most configurations. Net: a real vulnerability worth patching, but not an emergency unless the cookie config is attacker-influenceable (e.g. env-injected) AND the prototype-pollution chain (GHSA-hxj9-33pp-j2cc) is also present to enable full unauthenticated RCE.

In a deployment where Elysia's cookie config (e.g. the signing secret or domain) is populated from an environment variable the attacker can influence, and a cookie schema is defined on a route with AOT compilation enabled (default), the attacker sets the config value to a crafted string like ' + console.log('pwned') + ' which is injected unsanitised into the compiled route function and executed as server-side code. A public POC (sportshead/elysia-poc) and a patch test case confirm the technique; chaining with GHSA-hxj9-33pp-j2cc (prototype pollution) upgrades this to a full RCE chain.