CVE-2025-62713 Kottster app reinitialization can be re-triggered allowing command injection in development mode
Attackers can execute arbitrary commands via pre-authentication RCE in Kottster admin panel when running in development mode.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-62713?
CVE-2025-62713 is a high-severity command injection vulnerability in kottster, published on 23 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode. This affects development mode only, production deployments were never affected. This issue has been fixed in version 3.3.2.
Which versions are affected by CVE-2025-62713?
2 open source packages ship an affected version, including @kottster/server.
| Package | Affected | Fixed in |
|---|---|---|
@kottster/server npm | From 3.2.0 | 3.3.2 |
@kottster/server npm | From 3.2.0 | 3.3.2 |
How do I fix CVE-2025-62713?
Upgrade @kottster/server to 3.3.2 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-62713 being exploited?
There is no known exploitation of CVE-2025-62713 in the wild and no public exploit code.
Sources
Also known as GHSA-j3w7-9qc3-g96p.