CVE-2025-8022

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-8022
Rejected reason: Bun Shell does not invoke /bin/sh, or any other interpreter, for template literals created with the $ function. Each ${…} interpolation is treated as a single argument. The security responsibility for this usage pattern lies with the calling application, which must ensure the sanitization and validation of any untrusted arguments before passing them to the executed commands. Therefore, the potential for command injection is not a flaw within Bun itself; rather, it is an argument injection that is contingent on its implementation by the consuming application.
CVSS

No CVSS.

References

No reference.

Configurations

No configuration.

History

11 Aug 2025, 10:15

Type Values Removed Values Added
CWE CWE-78
Summary
  • (es) Todas las versiones de package bun son vulnerables a la neutralización incorrecta de elementos especiales utilizados en un comando del sistema operativo ('Inyección de comandos del sistema operativo') en la API $shell debido a la neutralización incorrecta de la entrada del usuario. Un atacante puede aprovechar esto proporcionando una entrada especialmente manipulada que incluya argumentos de la línea de comandos o metacaracteres de shell, lo que provoca la ejecución no deseada de comandos.
Summary (en) Versions of the package bun after 0.0.12 are vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the $ shell API due to improper neutralization of user input. An attacker can exploit this by providing specially crafted input that includes command-line arguments or shell metacharacters, leading to unintended command execution. **Note:** This issue relates to the widely known and actively developed 'Bun' JavaScript runtime. The bun package on NPM at versions 0.0.12 and below belongs to a different and older project that happened to claim the 'bun' name in the past. (en) Rejected reason: Bun Shell does not invoke /bin/sh, or any other interpreter, for template literals created with the $ function. Each ${…} interpolation is treated as a single argument. The security responsibility for this usage pattern lies with the calling application, which must ensure the sanitization and validation of any untrusted arguments before passing them to the executed commands. Therefore, the potential for command injection is not a flaw within Bun itself; rather, it is an argument injection that is contingent on its implementation by the consuming application.
CVSS v2 : unknown
v3 : 8.8 		v2 : unknown
v3 : unknown
References
  • {'url': 'https://gist.github.com/lirantal/9780d664037f29d5277d7b2bc569d213', 'source': 'report@snyk.io'}
  • {'url': 'https://security.snyk.io/vuln/SNYK-JS-BUN-9510752', 'source': 'report@snyk.io'}

11 Aug 2025, 07:15

Type Values Removed Values Added
CWE CWE-78
Summary
  • (es) Todas las versiones de package bun son vulnerables a la neutralización incorrecta de elementos especiales utilizados en un comando del sistema operativo ('Inyección de comandos del sistema operativo') en la API $shell debido a la neutralización incorrecta de la entrada del usuario. Un atacante puede aprovechar esto proporcionando una entrada especialmente manipulada que incluya argumentos de la línea de comandos o metacaracteres de shell, lo que provoca la ejecución no deseada de comandos.
Summary (en) Rejected reason: Bun Shell does not invoke /bin/sh, or any other interpreter, for template literals created with the $ function. Each ${…} interpolation is treated as a single argument. The security responsibility for this usage pattern lies with the calling application, which must ensure the sanitization and validation of any untrusted arguments before passing them to the executed commands. Therefore, the potential for command injection is not a flaw within Bun itself; rather, it is an argument injection that is contingent on its implementation by the consuming application. (en) Versions of the package bun after 0.0.12 are vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the $ shell API due to improper neutralization of user input. An attacker can exploit this by providing specially crafted input that includes command-line arguments or shell metacharacters, leading to unintended command execution. **Note:** This issue relates to the widely known and actively developed 'Bun' JavaScript runtime. The bun package on NPM at versions 0.0.12 and below belongs to a different and older project that happened to claim the 'bun' name in the past.
References
  • () https://gist.github.com/lirantal/9780d664037f29d5277d7b2bc569d213 -
  • () https://security.snyk.io/vuln/SNYK-JS-BUN-9510752 -
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8

10 Aug 2025, 13:15

Type Values Removed Values Added
CWE CWE-78
References
  • {'url': 'https://gist.github.com/lirantal/9780d664037f29d5277d7b2bc569d213', 'source': 'report@snyk.io'}
  • {'url': 'https://security.snyk.io/vuln/SNYK-JS-BUN-9510752', 'source': 'report@snyk.io'}
CVSS v2 : unknown
v3 : 8.8 		v2 : unknown
v3 : unknown
Summary
  • (es) Todas las versiones de package bun son vulnerables a la neutralización incorrecta de elementos especiales utilizados en un comando del sistema operativo ('Inyección de comandos del sistema operativo') en la API $shell debido a la neutralización incorrecta de la entrada del usuario. Un atacante puede aprovechar esto proporcionando una entrada especialmente manipulada que incluya argumentos de la línea de comandos o metacaracteres de shell, lo que provoca la ejecución no deseada de comandos.
Summary (en) Versions of the package bun after 0.0.12 are vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the $ shell API due to improper neutralization of user input. An attacker can exploit this by providing specially crafted input that includes command-line arguments or shell metacharacters, leading to unintended command execution. **Note:** This issue relates to the widely known and actively developed 'Bun' JavaScript runtime. The bun package on NPM at versions 0.0.12 and below belongs to a different and older project that happened to claim the 'bun' name in the past. (en) Rejected reason: Bun Shell does not invoke /bin/sh, or any other interpreter, for template literals created with the $ function. Each ${…} interpolation is treated as a single argument. The security responsibility for this usage pattern lies with the calling application, which must ensure the sanitization and validation of any untrusted arguments before passing them to the executed commands. Therefore, the potential for command injection is not a flaw within Bun itself; rather, it is an argument injection that is contingent on its implementation by the consuming application.

24 Jul 2025, 07:15

Type Values Removed Values Added
Summary
  • (es) Todas las versiones de package bun son vulnerables a la neutralización incorrecta de elementos especiales utilizados en un comando del sistema operativo ('Inyección de comandos del sistema operativo') en la API $shell debido a la neutralización incorrecta de la entrada del usuario. Un atacante puede aprovechar esto proporcionando una entrada especialmente manipulada que incluya argumentos de la línea de comandos o metacaracteres de shell, lo que provoca la ejecución no deseada de comandos.
Summary (en) All versions of the package bun are vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the $ shell API due to improper neutralization of user input. An attacker can exploit this by providing specially crafted input that includes command-line arguments or shell metacharacters, leading to unintended command execution. (en) Versions of the package bun after 0.0.12 are vulnerable to Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the $ shell API due to improper neutralization of user input. An attacker can exploit this by providing specially crafted input that includes command-line arguments or shell metacharacters, leading to unintended command execution. **Note:** This issue relates to the widely known and actively developed 'Bun' JavaScript runtime. The bun package on NPM at versions 0.0.12 and below belongs to a different and older project that happened to claim the 'bun' name in the past.

23 Jul 2025, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-23 05:15

Updated : 2025-08-11 10:15

NVD link : CVE-2025-8022

Mitre link : CVE-2025-8022

CVE.ORG link : CVE-2025-8022

JSON object : View

Products Affected

No product.

CWE

No CWE.