CVE-2025-66457: 
JavaScript vulnerability analysis and mitigation

CVE-2025-66457 is a code injection vulnerability in the Elysia Node.js web framework (npm package elysia) that allows arbitrary code execution via unsanitized cookie configuration values. When dynamic cookies are enabled (i.e., a cookie schema exists for a route), the cookie configuration — including fields like secrets and sign — is injected directly into compiled route code without sanitization, enabling code injection. All versions of Elysia before 1.4.18 are affected. The vulnerability was published on December 9, 2025, with a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 7.5 (High) (GitHub Advisory).

The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection). Elysia uses ahead-of-time (AOT) compilation to build optimized route handler functions as strings that are later evaluated. When a route has a cookie schema, cookie configuration values such as secrets and sign are interpolated directly into these generated code strings using single-quoted string literals, without escaping special characters like backticks or ${. An attacker (or misconfigured environment) that can control the cookie config — for example, via an environment variable like COOKIE_DOMAIN or secrets — can inject arbitrary JavaScript that executes when the route is compiled. A proof-of-concept payload demonstrates this: setting secrets to ` + console.log('pwned') + ` causes the injected expression to execute at route compilation time. When chained with CVE-2025-66456 (GHSA-hxj9-33pp-j2cc, a prototype pollution vulnerability in the same package), this enables a full unauthenticated remote code execution chain (GitHub Advisory, Patch Commit).

Successful exploitation results in arbitrary code execution on the server running the Elysia application, with full confidentiality, integrity, and availability impact. An attacker who can control cookie configuration values (e.g., via environment variables provisioned to the application) can execute arbitrary JavaScript in the server process context, enabling data exfiltration, system modification, service disruption, and potential lateral movement within the hosting environment. When combined with the companion prototype pollution vulnerability (CVE-2025-66456), an unauthenticated remote attacker can achieve a complete RCE chain without requiring direct source code access (GitHub Advisory).

A public proof-of-concept exploit repository is available at https://github.com/sportshead/elysia-poc, demonstrating the full RCE chain when combined with CVE-2025-66456. Standalone exploitation of CVE-2025-66457 requires write access to the cookie configuration (e.g., via environment variable injection), making it a lower-privilege but still dangerous attack vector (CVSS v3.1 PR:L). There is no confirmed evidence of in-the-wild exploitation as of the advisory date. The EPSS score is approximately 0.066% (low probability of near-term exploitation). The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, Feedly).

1. Identify target: Locate an Elysia application (npm package elysia < 1.4.18) with AOT compilation enabled (default) and at least one route using a cookie schema (t.Cookie({...})).
2. Gain config control: Obtain write access to the cookie configuration — most realistically by controlling an environment variable that is passed to the Elysia constructor's cookie options (e.g., secrets: process.env.COOKIE_SECRET).
3. Inject malicious payload: Set the controlled config value to a JavaScript injection string that breaks out of the single-quoted string context in the generated code. Example payload for secrets:

   ` + require('child_process').execSync('id').toString() + `

4. Trigger route compilation: The injected code executes when Elysia compiles the route handler (at application startup or first request), not at request time, so no HTTP request to the vulnerable route is needed after the config is set.
5. Chain with prototype pollution (optional): To achieve unauthenticated RCE without config write access, first exploit CVE-2025-66456 (GHSA-hxj9-33pp-j2cc) to pollute the prototype and influence the cookie config object, then trigger CVE-2025-66457 to execute arbitrary code (GitHub Advisory, PoC Repo).

• Logs: Unexpected output or errors in application startup logs related to cookie configuration or route compilation; JavaScript evaluation errors in the Elysia process log at startup.
• Process: Unusual child processes spawned by the Node.js/Bun Elysia server process (e.g., sh, bash, curl, wget) at application startup time rather than during request handling.
• Environment: Environment variables containing backtick characters (`), ${, or JavaScript expression syntax in fields expected to hold cookie secrets or domain names (e.g., COOKIE_SECRET, COOKIE_DOMAIN).
• File System: Unexpected files written by the server process at startup; new cron jobs or persistence mechanisms created by the application service account.
• Network: Outbound connections from the Elysia server process to unexpected external hosts immediately after application startup (GitHub Advisory).

Upgrade Elysia to version 1.4.18 (or 1.4.17 as the initial patch release) which introduces the overrideUnsafeQuote sanitization helper that escapes backticks and ${ sequences in cookie config values before code generation (Patch Commit, PR #1564). As a workaround if immediate upgrade is not possible, sanitize all cookie-related environment inputs before passing them to the Elysia constructor using the following pattern:

const overrideUnsafeQuote = (value: string) =>
  '`' + value.replace(/`/g, '\\`').replace(/\${/g, '$\\{') + '`'

Additionally, disable dynamic cookie configurations if not explicitly required, implement strict input validation for all cookie config values, and audit/restrict write access to application configuration and environment variables (GitHub Advisory).

The vulnerability was discovered and reported by security researcher sportshead, who also published the proof-of-concept exploit repository. The Elysia maintainer (SaltyAom) promptly patched both CVE-2025-66457 and the related CVE-2025-66456 in the same pull request (#1564), released on December 2, 2025, with the advisory published December 9, 2025. The advisory notes that standalone exploitability is generally low due to the prerequisite of config write access, but highlights the critical risk when chained with the prototype pollution vulnerability (GitHub Advisory, PR #1564).