GitHub Advisoryadvisory · Go

GHSA-f9f4-5859-29mf sqls-server/sqls is vulnerable to command injection in the config command

HIGH Published 2025-10-30 Modified 2025-11-05 Official page ↗
Aliases
CVE-2025-61141
Ecosystem
Go
Packages
github.com/sqls-server/sqls
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-77
Reviewed
2025-10-31

Affected packages

• Go github.com/sqls-server/sqls: 0.2.28 (no fix yet)

Description

sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR environment variable and config file path to sh -c without sanitization, allowing attackers to execute arbitrary commands. This issue has been patched via commit https://github.com/sqls-server/sqls/commit/468a23fc89af89f632cc023a10c031e4bc781797.

Related

Alias · CVE (1)

  • CVE-2025-61141 sqls-server/sqls 0.2.28 is vulnerable to command injection in the config command because the openEditor function passes the EDITOR… vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References