Elysia affected by arbitrary code injection through cookie config
Summary
CVE-2025-66457: Elysia affected by arbitrary code injection through cookie config. Affects elysia versions < 1.4.18. Fixed in 1.4.18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Arbitrary code execution from cookie config. If dynamic cookies are enabled (ie there exists a schema for cookies), the cookie config is injected into the compiled route without first being sanitised.
Availability of this exploit is generally low, as it requires write access to either the Elysia app's source code (in which case the vulnerability is meaningless) or write access to the cookie config (perhaps where it is assumed to be provisioned by the environment).
However when combined with GHSA-hxj9-33pp-j2cc, this vulnerability allows for a full RCE chain.
Impact
- aot enabled (default)
- cookie schema passed to route
- Cookie config controllable eg. via env
Example of vulnerable code
new Elysia({
cookie: {
secrets: `' + console.log('pwned from secrets') + '`
},
})
.get("/", () => "hello world", {
cookie: t.Cookie({
foo: t.Any(),
}),
})
POC: https://github.com/sportshead/elysia-poc
Patches
Patched by 1.4.17 (https://github.com/elysiajs/elysia/pull/1564)
Reference commit:
- https://github.com/elysiajs/elysia/pull/1564/commits/26935bf76ebc43b4a43d48b173fc853de43bb51e
- https://github.com/elysiajs/elysia/pull/1564/commits/3af978663e437dccc6c1a2a3aff4b74e1574849e
Workarounds
Sanitize cookie-related env input
const overrideUnsafeQuote = (value: string) =>
// '`' + value + '`'
'`' + value.replace(/'/g, '\\`').replace(/\${/g, '$\\{') + '`'
How To Fix
Latest published version: 1.4.30 as of 23 Oct 2026
npm install elysia@1.4.30Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.18
This is the first release that contains the fix.
npm install elysia@1.4.18Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
References
Related vulnerabilities
Recent vulnerabilities recorded for elysia.
