https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 07:39:35 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-256727 EUVD-2026-256727 https://cve.radiocsirt.org/vuln/euvd-2026-256727 https://cve.radiocsirt.org/vuln/fkie_cve-2025-62713 <p>Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode. This affects development mode only, production deployments were never affected. This issue has been fixed in version 3.3.2.</p> <p>Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode. This affects development mode only, production deployments were never affected. This issue has been fixed in version 3.3.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-62713 https://cve.radiocsirt.org/vuln/ghsa-j3w7-9qc3-g96p <p><strong>Affected:</strong> npm: @kottster/server</p> <p>### Impact</p> <p>**Development mode only**. Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode.</p> <p>The vulnerability combines two issues: 1. The `initApp` action can be called repeatedly without checking if the app is already initialized, allowing attackers to create a new root admin account and obtain a JWT token 2. The `installPackagesForDataSource` action uses unescaped command arguments, enabling command injection</p> <p>An attacker with access to a locally running development instance can chain these vulnerabilities to: - Reinitialize the application and receive a JWT token for a new root account - Use this token to authenticate - Execute arbitrary system commands through `installPackagesForDataSource`</p> <p>**Production deployments were never affected.**</p> <p>### Patches</p> <p>Fixed in [v3.3.2](https://github.com/kottster/kottster/releases/tag/v3.3.2).</p> <p>Specifically, `@kottster/server` [v3.3.2](https://www.npmjs.com/package/@kottster/server/v/3.3.2) and `@kottster/cli` [v3.3.2](https://www.npmjs.com/package/@kottster/cli/v/3.3.2) address this vulnerability.</p> <p>We recommend developers using earlier versions of `@kottster/server` and `@kottster/cli` update all the core packages to latest release:</p> <p>``` npm install @kottster/common@latest @kottster/cli@latest @kottster/server@latest @kottster/react@latest ```</p> <p>### Workarounds</p> <p>- Do not expose development servers to public networks or untrusted users - Use production mode for any deployment…</p> <p><strong>Affected:</strong> npm: @kottster/server</p> <p>### Impact</p> <p>**Development mode only**. Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode.</p> <p>The vulnerability combines two issues: 1. The `initApp` action can be called repeatedly without checking if the app is already initialized, allowing attackers to create a new root admin account and obtain a JWT token 2. The `installPackagesForDataSource` action uses unescaped command arguments, enabling command injection</p> <p>An attacker with access to a locally running development instance can chain these vulnerabilities to: - Reinitialize the application and receive a JWT token for a new root account - Use this token to authenticate - Execute arbitrary system commands through `installPackagesForDataSource`</p> <p>**Production deployments were never affected.**</p> <p>### Patches</p> <p>Fixed in [v3.3.2](https://github.com/kottster/kottster/releases/tag/v3.3.2).</p> <p>Specifically, `@kottster/server` [v3.3.2](https://www.npmjs.com/package/@kottster/server/v/3.3.2) and `@kottster/cli` [v3.3.2](https://www.npmjs.com/package/@kottster/cli/v/3.3.2) address this vulnerability.</p> <p>We recommend developers using earlier versions of `@kottster/server` and `@kottster/cli` update all the core packages to latest release:</p> <p>``` npm install @kottster/common@latest @kottster/cli@latest @kottster/server@latest @kottster/react@latest ```</p> <p>### Workarounds</p> <p>- Do not expose development servers to public networks or untrusted users - Use production mode for any deployment…</p> https://cve.radiocsirt.org/vuln/ghsa-j3w7-9qc3-g96p