https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T07:39:55.759312+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-256727 EUVD-2026-256727 2026-10-18T07:39:55.761215+00:00 EUVD-2026-256727 https://cve.radiocsirt.org/vuln/fkie_cve-2025-62713 fkie_cve-2025-62713 2026-10-18T07:39:55.761246+00:00

Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode. This affects development mode only, production deployments were never affected. This issue has been fixed in version 3.3.2.

 https://cve.radiocsirt.org/vuln/ghsa-j3w7-9qc3-g96p GHSA-j3w7-9qc3-g96p — Kottster app reinitialization can be re-triggered allowing command injection in development mode 2026-10-18T07:39:55.761277+00:00

Affected: npm: @kottster/server

### Impact

**Development mode only**. Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode.

The vulnerability combines two issues: 1. The `initApp` action can be called repeatedly without checking if the app is already initialized, allowing attackers to create a new root admin account and obtain a JWT token 2. The `installPackagesForDataSource` action uses unescaped command arguments, enabling command injection

An attacker with access to a locally running development instance can chain these vulnerabilities to: - Reinitialize the application and receive a JWT token for a new root account - Use this token to authenticate - Execute arbitrary system commands through `installPackagesForDataSource`

**Production deployments were never affected.**

### Patches

Fixed in [v3.3.2](https://github.com/kottster/kottster/releases/tag/v3.3.2).

Specifically, `@kottster/server` [v3.3.2](https://www.npmjs.com/package/@kottster/server/v/3.3.2) and `@kottster/cli` [v3.3.2](https://www.npmjs.com/package/@kottster/cli/v/3.3.2) address this vulnerability.

We recommend developers using earlier versions of `@kottster/server` and `@kottster/cli` update all the core packages to latest release:

``` npm install @kottster/common@latest @kottster/cli@latest @kottster/server@latest @kottster/react@latest ```

### Workarounds

- Do not expose development servers to public networks or untrusted users - Use production mode for any deployment…