CVE-2025-57282: ngrok Command Injection Vulnerability
Summary
CVE-2025-57282: ngrok is Vulnerable to Command Injection. Affects ngrok versions 4.3.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ngrok is a widely used tool that enables developers to expose local servers to the internet securely. It provides features such as secure tunnels, custom subdomains, and traffic inspection, making it essential for testing webhooks and APIs. However, certain versions of ngrok have been found to be vulnerable to command injection, which could allow attackers to execute arbitrary commands on the host system.
Vulnerability Detail
The vulnerability in ngrok versions 4.3.3 and 5.0.0-beta.2 stems from improper handling of user input, which allows an attacker to inject malicious commands. This could lead to unauthorized access, data breaches, or system compromise. The vulnerability is classified under CWE-77, indicating a command injection flaw. The potential ramifications are severe, as an attacker could gain control over the affected system, leading to data loss or further exploitation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If you cannot update ngrok immediately, consider restricting access to the ngrok service and ensuring that only trusted users can interact with it. Additionally, avoid using ngrok in environments where sensitive data is handled until the vulnerability is resolved.
Conclusion
The command injection vulnerability in ngrok versions 4.3.3 and 5.0.0-beta.2 poses a significant risk to users. It is crucial to update to the latest version to mitigate this risk. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for ngrok →
FAQ
ngrok versions 4.3.3 and 5.0.0-beta.2 are vulnerable to command injection.
Command injection is a security vulnerability that allows an attacker to execute arbitrary commands on a host operating system via a vulnerable application.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
An attacker could exploit this vulnerability to execute arbitrary commands, potentially leading to unauthorized access, data breaches, or system compromise.
Yes, the CVSS score for this vulnerability is 8.8, indicating a high severity level.
