CVE-2025-66457
📋 TL;DR
CVE-2025-66457 allows arbitrary code execution in Elysia framework when dynamic cookies are enabled. Attackers can inject malicious cookie configurations to execute code on the server. This affects Elysia applications using dynamic cookie schemas in versions 1.4.17 and below.
💻 Affected Systems
- Elysia
📦 What is this software?
Elysia by Elysiajs
⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Limited code execution within the application context, potentially allowing data access or further privilege escalation.
If Mitigated
No impact if dynamic cookies are disabled or proper input validation is implemented.
🎯 Exploit Status
Exploitation requires write access to cookie configuration. Full RCE chain requires combination with GHSA-hxj9-33pp-j2cc.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.18
Vendor Advisory: https://github.com/elysiajs/elysia/security/advisories/GHSA-8vch-m3f4-q8jf
Restart Required: Yes
Instructions:
1. Update Elysia package to version 1.4.18 or higher. 2. Run 'npm update elysia' or 'yarn upgrade elysia'. 3. Restart the application server.
🔧 Temporary Workarounds
Disable dynamic cookies
allDisable dynamic cookie functionality in Elysia configuration
Set dynamic cookies to false in Elysia app configuration
Implement cookie validation
allAdd strict validation for all cookie inputs before processing
Implement input sanitization for cookie parameters
🧯 If You Can't Patch
- Disable dynamic cookie functionality entirely
- Implement strict input validation and sanitization for all cookie parameters
🔍 How to Verify
Check if Vulnerable:
Check package.json for Elysia version <=1.4.17 and verify if dynamic cookies are enabled in configurationCheck Version:
npm list elysia | grep elysiaVerify Fix Applied:
Verify Elysia version is 1.4.18 or higher in package.json and restart application📡 Detection & Monitoring
Log Indicators:
- Unusual cookie payloads in request logs
- Unexpected process executions from Elysia application
Network Indicators:
- Suspicious cookie values in HTTP requests
- Unusual outbound connections from application server
SIEM Query:
source="application.logs" AND ("cookie" AND ("exec" OR "eval" OR "system"))🔗 References
- https://github.com/elysiajs/elysia/commit/26935bf76ebc43b4a43d48b173fc853de43bb51e
- https://github.com/elysiajs/elysia/commit/3af978663e437dccc6c1a2a3aff4b74e1574849e
- https://github.com/elysiajs/elysia/pull/1564
- https://github.com/elysiajs/elysia/security/advisories/GHSA-8vch-m3f4-q8jf
- https://github.com/elysiajs/elysia/security/advisories/GHSA-hxj9-33pp-j2cc
- https://github.com/sportshead/elysia-poc
