Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@kottster/server

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.2npmAmendedPublished

    Kottster app reinitialization can be re-triggered allowing command injection in development mode

    CVE-2025-62713 · GHSA-j3w7-9qc3-g96p

    Affected
    • npm @kottster/server >= 3.2.0, < 3.3.2
    Fixed in
    3.3.2· Vendor fix available
    Issue
    Impact Development mode only. Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode. The vulnerability combines two issues: 1. The initApp action can be called repeatedly without checking if the app is already initialized, allowing attackers to create a new root admin account and obtain a JWT token 2. The installPackagesForDataSource action uses unescaped command arguments, enabling command injection An attacker with access to a locally running development instance can chain these vulnerabilities to: - Reinitialize the application and receive a JWT token for a new root account - Use this token to authenticate - Execute arbitrary system commands through installPackagesForDataSource Production deployments were never affected. Patches Fixed in v3.3.2. Specifically, @kottster/server v3.3.2 and @kottster/cli v3.3.2 address this vulnerability. We recommend developers using earlier versions of @kottster/server and @kottster/cli…

    Recommended action: Upgrade to 3.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →