CVE-2022-25908

🗓️ 24 Jan 2023 05:00:01Reported by snykType

All versions of create-choo-electron package are vulnerable to Command Injection via devInstall function. Improper user-input sanitization

Reporter	Title	Published	Views	Family All 15
IBM Security Bulletins	Security Bulletin: There is a security vulnerability in Node.js create-choo-electron module used by IBM Maximo for Civil Infrastructure in Maximo Application Suite (CVE-2022-25908)	29 Mar 202309:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Ceph is vulnerable to OS Command Injection in Grafana (CVE-2022-25912, CVE-2022-25860, CVE-2022-25908)	5 Aug 202420:42	–	ibm
Circl	CVE-2022-25908	1 Apr 202515:32	–	circl
CNNVD	npm create-choo-electron 安全漏洞	26 Jan 202300:00	–	cnnvd
Cvelist	CVE-2022-25908	24 Jan 202305:00	–	cvelist
EUVD	EUVD-2023-0492	3 Oct 202520:07	–	euvd
Github Security Blog	Command Injection in create-choo-electron	26 Jan 202321:30	–	github
NVD	CVE-2022-25908	26 Jan 202321:15	–	nvd
OSV	GHSA-J8WR-FWF2-VVR9 Command Injection in create-choo-electron	26 Jan 202321:30	–	osv
Prion	Command injection	26 Jan 202321:15	–	prion

NVD

Node

create-choo-electron_project create-choo-electronnode.js

[
  {
    "product": "create-choo-electron",
    "versions": [
      {
        "version": "0",
        "lessThan": "*",
        "status": "affected",
        "versionType": "semver"
      }
    ],
    "vendor": "n/a"
  }
]

Source	Link
security	www.security.snyk.io/vuln/SNYK-JS-CREATECHOOELECTRON-3157953

17 Jun 2026 04:34Current

9.7High risk

Vulners AI Score9.7

CVSS 3.17.4 - 9.8

EPSS0.01547

SSVC