CVE-2022-24753: Code injection in Stripe CLI on Windows
Summary
CVE-2022-24753: Code injection in Stripe CLI on windows. Affects github.com/stripe/stripe-cli versions < 1.7.13. Fixed in 1.7.13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Stripe CLI is a command-line tool developed by Stripe, a popular online payment processing platform. It allows developers to interact with Stripe's API and perform various tasks related to managing payments, subscriptions, and other Stripe features. The CLI is written in Go and is primarily used on Windows, MacOS, and Linux operating systems. However, this vulnerability specifically affects the Windows version of Stripe CLI.
Vulnerability Detail
The vulnerability in Stripe CLI on Windows arises when certain commands are executed in a directory where an attacker has planted malicious files. The commands affected by this vulnerability are 'stripe login', 'stripe config -e', 'stripe community', and 'stripe open'. When these commands are run in the compromised directory, an attacker can inject and execute arbitrary code within the context of the current user. This can lead to unauthorized access, data theft, or further compromise of the system. It's important to note that this vulnerability does not impact the MacOS and Linux versions of Stripe CLI.
How To Fix
Latest published version: v1.55.0 as of 22 Oct 2026
go get github.com/stripe/stripe-cli@v1.55.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.7.13
This is the first release that contains the fix.
go get github.com/stripe/stripe-cli@v1.7.13Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that they only run the affected commands in trusted directories and regularly update their Stripe CLI installation to the latest version.
Conclusion
The vulnerability in Stripe CLI on Windows allows for code injection when certain commands are run in a compromised directory. Upgrading to Stripe CLI version 1.7.13 or later is recommended to mitigate this vulnerability. It is important to stay updated with the latest security patches and follow best practices to ensure the security of your systems.
See every vulnerability recorded for github.com/stripe/stripe-cli →
FAQ
Stripe CLI is a command-line tool developed by Stripe that allows developers to interact with Stripe's API and perform various tasks related to managing payments, subscriptions, and other Stripe features.
This vulnerability specifically affects the Windows version of Stripe CLI. The MacOS and Linux versions are not impacted.
The commands 'stripe login', 'stripe config -e', 'stripe community', and 'stripe open' are affected by this vulnerability.
Successful exploitation of this vulnerability allows an attacker to run arbitrary code within the context of the current user, potentially leading to unauthorized access, data theft, or further compromise of the system.
There is no evidence of exploitation of this vulnerability at the time of reporting.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/stripe/stripe-cli.
