ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2025-48069

ejson2env allows users to decrypt EJSON secrets and export them as environment variables.

Published May 21, 2025 · catalog updated May 21, 2025 · Shopify

Check if you run it

No confirmed exploitation is on record for CVE-2025-48069. EPSS is 1.42%. Act only if a listed version of Shopify is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium6.6
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
1.42%
Remediation
Version ranges on file
Affected products
vendor Shopify ejson2env < 2.0.8

ejson2env allows users to decrypt EJSON secrets and export them as environment variables. Prior to version 2.0.8, the tool has a vulnerability related to how it writes to . Specifically, the tool is intended to write an export statement for environment variables and their values. However, due to inadequate output sanitization, there is a potential risk where variable names or values may include malicious content, resulting in additional unintended commands being output to . If this output is improperly utilized in further command execution, it could lead to command injection, allowing an attac

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • vendor Shopify ejson2env < 2.0.8< 2.0.8

How to fix CVE-2025-48069

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2025-48069. EPSS is 1.42%. Act only if a listed version of Shopify is installed.

Which versions are affected?

Compare what you have installed with Shopify ejson2env < 2.0.8 < 2.0.8. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS 1.42%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. May 21, 2025 · EUVD

    Detected

    ejson2env allows users to decrypt EJSON secrets and export them as environment variables. Prior to version 2.0.8, the tool has a vulnerability related to how it writes to . Specifically, the tool is intended to write an export statement for environment variables and their values. However, due to inadequate output sanitization, there is a potential risk where variable names or values may include ma

  2. May 21, 2025 · EUVD

    Updated

    ejson2env allows users to decrypt EJSON secrets and export them as environment variables. Prior to version 2.0.8, the tool has a vulnerability related to how it writes to . Specifically, the tool is intended to write an export statement for environment variables and their values. However, due to inadequate output sanitization, there is a potential risk where variable names or values may include ma

Sources

  • CVE.orgVulnerability recordCVE-2025-48069

    Official CVE identifier

    cve.org
  • EUVDVulnerability recordEUVD-2025-16051

    ejson2env allows users to decrypt EJSON secrets and export them as environment variables. Prior to version 2.0.8, the tool has a vulnerability related to how it writes to . Specifically, the tool is intended to write an export statement for environment variables and their values.

    euvd.enisa.europa.eu

References

Freshness

Last verified in this catalog May 21, 2025. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.