CVE-2025-61141
High · 7.5CVSS
7.5
EPSS
1.1%
Published
Oct 30, 2025
CISA due date
—
The record
sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environment variable and config file path to sh -c without sanitization, allowing attackers to execute arbitrary commands.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/sqls-server/sqls | 0 | No fix |
| Go | github.com/sqls-server/sqls | 0.2.28 | No fix |
| go | github.com/sqls-server/sqls | 0.2.28 | No fix |
| openSUSE:Tumbleweed | govulncheck-vulndb | 0 | 0.0.20251105T184115-1.1 |
Related vulnerabilities
- CVE-2025-54471 NeuVector used a hard-coded cryptographic key embedded in the source code. Also affects govulncheck-vulndb
- CVE-2025-54470 This vulnerability affects NeuVector deployments only when the Report anonymous cluster… Also affects govulncheck-vulndb
- CVE-2025-54469 A vulnerability was identified in NeuVector, where the enforcer used environment… Also affects govulncheck-vulndb
- CVE-2024-58269 A vulnerability has been identified in Rancher Manager, where sensitive information… Also affects govulncheck-vulndb
- CVE-2023-32199 A vulnerability has been identified within Rancher Manager, where after removing a custom… Also affects govulncheck-vulndb
- CVE-2025-64101 ZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header Injection Also affects govulncheck-vulndb
- CVE-2025-64103 Zitadel May Bypass Second Authentication Factor Also affects govulncheck-vulndb
- CVE-2025-64102 Zitadel allows brute-forcing authentication factors Also affects govulncheck-vulndb