Arbitrary Code Execution Vulnerability in Elysia Framework by ElysiaJS

CVE-2025-66457

What is CVE-2025-66457?

The Elysia Framework, a popular Typescript solution for request validation and client-server communication, has a security flaw that allows arbitrary code execution via dynamic cookie configurations. Specifically, versions 1.4.17 and earlier do not properly sanitize the injected cookie configuration, which could be exploited under certain conditions. Although the exploit's availability is generally low, it poses a serious risk when paired with other vulnerabilities, such as GHSA-hxj9-33pp-j2cc. Successful exploitation requires either write access to the application's source code or an ability to modify the cookie config administratively. This vulnerability has been addressed in version 1.4.18.

References