CVE-2025-61141 sqls-server/sqls is vulnerable to command injection in the config command
Attackers can execute arbitrary commands via the EDITOR environment variable in the sqls-server/sqls tool, requiring an upgrade to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-61141?
CVE-2025-61141 is a high-severity command injection vulnerability in n/a, published on 30 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environment variable and config file path to sh -c without sanitization, allowing attackers to execute arbitrary commands.
Weakness: CWE-77
Which versions are affected by CVE-2025-61141?
3 open source packages ship an affected version, including github.com/sqls-server/sqls.
| Package | Affected | Fixed in |
|---|---|---|
github.com/sqls-server/sqls Go | All versions | None |
github.com/sqls-server/sqls Go | All versions | None |
github.com/sqls-server/sqls Go | All versions | None |
How do I fix CVE-2025-61141?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-61141 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-61141 exists.
Sources
Also known as GHSA-f9f4-5859-29mf, GO-2025-4088.