CVE-2025-62713
NoneCVSS
—
EPSS
0.6%
Published
Oct 23, 2025
CISA due date
—
The record
Kottster is a self hosted Node.js admin panel. From versions 3.2.0 to before 3.3.2, Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode. This affects development mode only, production deployments were never affected. This issue has been fixed in version 3.3.2.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @kottster/server | 3.2.0 | 3.3.2 |
Related vulnerabilities
- GHSA-j3w7-9qc3-g96p Kottster app reinitialization can be re-triggered allowing command injection in… Same vulnerability
- CVE-2026-96376 Improper Neutralization of Special Elements used in an OS Command ("OS Command… CWE-78
- CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113726 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113725 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113722 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-112943 launch-editor allows users to open files with line numbers in editor from Node.js. CWE-78