Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-f25h-ms5y-9fas
Vulnerability ID VCID-f25h-ms5y-9fas
Aliases CVE-2025-66457
GHSA-8vch-m3f4-q8jf
Summary Elysia affected by arbitrary code injection through cookie config Arbitrary code execution from cookie config. If dynamic cookies are enabled (ie there exists a schema for cookies), the cookie config is injected into the compiled route without first being sanitised. Availability of this exploit is generally low, as it requires write access to either the Elysia app's source code (in which case the vulnerability is meaningless) or write access to the cookie config (perhaps where it is assumed to be provisioned by the environment). However when combined with GHSA-hxj9-33pp-j2cc, this vulnerability allows for a full RCE chain.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
There are no known severity scores.
Reference id Reference type URL
https://github.com/elysiajs/elysia
https://github.com/elysiajs/elysia/commit/26935bf76ebc43b4a43d48b173fc853de43bb51e
https://github.com/elysiajs/elysia/commit/3af978663e437dccc6c1a2a3aff4b74e1574849e
https://github.com/elysiajs/elysia/pull/1564
https://github.com/sportshead/elysia-poc
CVE-2025-66457 https://nvd.nist.gov/vuln/detail/CVE-2025-66457
GHSA-8vch-m3f4-q8jf https://github.com/advisories/GHSA-8vch-m3f4-q8jf
GHSA-8vch-m3f4-q8jf https://github.com/elysiajs/elysia/security/advisories/GHSA-8vch-m3f4-q8jf
GHSA-hxj9-33pp-j2cc https://github.com/elysiajs/elysia/security/advisories/GHSA-hxj9-33pp-j2cc
No exploits are available.
There are no known vectors.

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2026-06-02T04:49:06.382743+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/elysia/CVE-2025-66457.yml 38.6.0