CVE-2025-61141
HIGH EPSS 62.3%
Published Oct 30, 20258mo ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
Published Oct 30, 2025 8mo ago
Last Modified Jun 17, 2026 2w ago
Description
sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environment variable and config file path to sh -c without sanitization, allowing attackers to execute arbitrary commands.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity High
Availability None
Threat Intelligence
EPSS Exploit Probability
62.3% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-77 Command Injection Injection
References 3
- advisory.dw1.io https://advisory.dw1.io/54/
- github.com https://github.com/sqls-server/sqls/
- lukmanern.github.io https://lukmanern.github.io/CVE-2025-61141.html
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.