Arbitrary Code Execution Vulnerability in Socket Firewall by SocketDev

CVE-2025-64726

What is CVE-2025-64726?

Socket Firewall, an HTTP/HTTPS proxy server developed by SocketDev, has a vulnerability that allows arbitrary code execution when run in untrusted project directories with versions prior to 0.15.5. This issue arises when a malicious actor places a crafted .sfw.config file within a project directory. During the execution of Socket Firewall commands, such as sfw npm install, the tool processes the configuration file, potentially populating harmful environment variables directly into the Node.js process. This allows attackers to exploit it by manipulating the NODE_OPTIONS variable to include --require directives, thereby executing malicious JavaScript code before the tool’s security mechanisms are engaged. Users are encouraged to upgrade to version 0.15.5 or later, which includes a fix that isolates configuration file values from subprocess environments, enhancing security against such exploits. It is crucial for developers to inspect .sfw.config and .env.local files before executing commands in new projects, especially if they are unsure of the source’s trustworthiness.

References