# CVE-2025-64726: External Control of System or Configuration Setting and Uncontrolled Search Path Element in sfw > Attackers can execute arbitrary code by placing a malicious config file in a project directory, bypassing security checks when developers run commands. - **Severity:** High 7.3 (`CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`) - **Exploited in the wild:** Not known - **Login needed:** Any signed-in user - **Attackable:** Local or same network only - **Victim action needed:** A user has to click or open something - **Fix available:** No - **Published:** 13 Nov 2025 - **Updated:** 13 Nov 2025 - **Also known as:** GHSA-6c5p-vqrh-h6fp ## What is CVE-2025-64726? CVE-2025-64726 is a high-severity code injection vulnerability in SocketDev firewall-release, published on 13 Nov 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link. ### Official description Socket Firewall is an HTTP/HTTPS proxy server that intercepts package manager requests and enforces security policies by blocking dangerous packages. Socket Firewall binary versions (separate from installers) prior to 0.15.5 are vulnerable to arbitrary code execution when run in untrusted project directories. The vulnerability allows an attacker to execute arbitrary code by placing a malicious `.sfw.config` file in a project directory. When a developer runs Socket Firewall commands (e.g., `sfw npm install`) in that directory, the tool loads the `.sfw.config` file and populates environment variables directly into the Node.js process. An attacker can exploit this by setting `NODE_OPTIONS` with a `--require` directive to execute malicious JavaScript code before Socket Firewall's security controls are initialized, effectively bypassing the tool's malicious package detection. The attack vector is indirect and requires a developer to install dependencies for an untrusted project and execute a command within the context of the untrusted project. The vulnerability has been patched in Socket Firewall version 0.15.5. Users should upgrade to version 0.15.5 or later. The fix isolates configuration file values from subprocess environments. Look at `sfw --version` for version information. If users rely on the recommended installation mechanism (e.g. global installation via `npm install -g sfw`) then no workaround is necessary. This wrapper package automatically ensures that users are running the latest version of Socket Firewall. Users who have manually installed the binary and cannot immediately upgrade should avoid running Socket Firewall in untrusted project directories. Before running Socket Firewall in any new project, inspect `.sfw.config` and `.env.local` files for suspicious `NODE_OPTIONS` or other environment variable definitions that reference local files. Weakness: CWE-427 (Uncontrolled Search Path Element), CWE-15 (External Control of System or Configuration Setting) ## Which versions are affected by CVE-2025-64726? ## How do I fix CVE-2025-64726? No fix has been published for CVE-2025-64726 yet. Limit exposure of the affected software until one is available. ## Is CVE-2025-64726 being exploited? It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-64726 exists. ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2025-64726 and fix it if it is affected. What it is: CVE-2025-64726 is a high-severity code injection vulnerability in SocketDev firewall-release, published on 13 Nov 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link. Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-64726 exists. Affected product: SocketDev firewall-release. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2025-64726/ (Markdown: https://insights.sbomify.com/CVE-2025-64726/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2025-64726 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-64726 - OSV: https://osv.dev/vulnerability/CVE-2025-64726 --- From sbomify Insights: https://insights.sbomify.com/CVE-2025-64726/ Summaries are generated and may contain mistakes; the official description above is the record.