CVE-2025-8022: bun Package OS Command Injection Vulnerability
Summary
CVE-2025-8022: bun vulnerable to OS Command Injection. Affects bun versions < 1.1.39. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The bun package is a JavaScript runtime that allows developers to build and run applications efficiently. It provides a shell API for executing commands within the operating system. However, due to improper handling of user input, it is susceptible to command injection attacks, which can lead to severe security risks.
Vulnerability Detail
The bun package is vulnerable to an OS Command Injection due to improper neutralization of special elements in user input. This vulnerability arises from the $ shell API, where an attacker can exploit the system by injecting specially crafted input that includes command-line arguments or shell metacharacters. This can lead to unintended command execution, potentially compromising the system's integrity and confidentiality.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, sanitize all user inputs before passing them to the $ shell API. This can be done by escaping special characters or validating input against a whitelist of acceptable values.
Conclusion
The bun package has a critical vulnerability (CVE-2025-8022) that allows for OS Command Injection due to improper input handling. It is essential to update to the latest version to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for bun →
FAQ
CVE-2025-8022 is a vulnerability in the bun package that allows for OS Command Injection due to improper handling of user input.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to unauthorized command execution, potentially compromising system security and data integrity.
Yes, updating the bun package to the latest version will patch the vulnerability.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for bun.
