CVE-2025-22606

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In version 4.0.0-beta.358 and possibly earlier versions, when creating or updating a "project," it is possible to inject arbitrary shell commands by altering the project name. If a name includes...

CVE-2025-22606 Coolify Command Injection Vulnerability in Project Name

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In version 4.0.0-beta.358 and possibly earlier versions, when creating or updating a "project," it is possible to inject arbitrary shell commands by altering the project name. If a name includes...

CVE-2025-22606

CVE-2025-22606 describes a command-injection vulnerability in Coolify caused by unsafely handling project names in versions up to 4.0.0-beta.358 (likely earlier). An attacker with access to project management could inject arbitrary shell commands by including unescaped characters (e.g., a single ...

CVE-2025-22606 Coolify Command Injection Vulnerability in Project Name

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In version 4.0.0-beta.358 and possibly earlier versions, when creating or updating a "project," it is possible to inject arbitrary shell commands by altering the project name. If a name includes...

MAL-2025-573 Malicious code in ig-ember-perf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 08dfb2ae328db2b79951b9cad3235bf7beae77c5c59ba261738dbcf740a1603c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ebay-testeru (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 10bc1dcc6bd74446e082ab66f1aa06c7ad778cd162497ed913f8b9678c4068b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eslint-config-scality (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 315c3576289454d26857298b5dd200578c8f7002ae98ec2a45a9d51ec1f8438d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bookingcom-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da4d630a63a612636008973224503694babc038514b8db52fe4e5bc3edea004c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in collapsible-group (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a424d4fcd62d35f9e9da962931dbc5fd39e9bfc3b4744a5f00c5e442b2ddb36 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in no-style-dependency (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9044d80b8ff33b0d2a50511386c0fed003004f9452211938b949aca211b0866 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-365 Malicious code in testidneel-test-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f2d741fc56c242ce7ac9590ccfe8a91cb20e28e9e9a3fdc9ac721258723cc082 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in testyyz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 82bc94189a84151717881b2111100b84166cfede990cd122a895d3f2316508d3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-331 Malicious code in another-depconf-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6876487b755ba50effc916826fdb407f0f653893569fef933deb61a21a8d6626 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in another-depconf-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6876487b755ba50effc916826fdb407f0f653893569fef933deb61a21a8d6626 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in groots645-npm-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 485143431e0e6dedf1f5c505cab6f34754b74c59b37948e1aa765d265a351c4b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-336 Malicious code in groots645-npm-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 485143431e0e6dedf1f5c505cab6f34754b74c59b37948e1aa765d265a351c4b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 1password-sdk-exapmles (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 98366c77213b87d7622472828c95aa7590386458d140ad0a0b31a86afde5b6ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-328 Malicious code in adblock-resources (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12430deae73d0c3ce495467b184a563ddc99e6301ab6f2c7a45445d917a78875 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-337 Malicious code in legacy_vis_analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28ff9d6e37ea3e8b2d1b4748cd469a912ac50750610b909bfcf67f1fdc42e720 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in libcrypt-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 986987a3ac2062033ac84907b4be4febb72b7c5e89c511e691bbac561f7045b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...