CVE-2025-27554: ToDesktop RCE Vulnerability

CVE-2025-27554 Overview

CVE-2025-27554 is a critical command injection vulnerability affecting ToDesktop before 2024-10-03 and applications built using it, including Cursor before 2024-10-03. The vulnerability allows remote attackers to execute arbitrary commands on the build server through a malicious postinstall script in package.json. This flaw could enable attackers to read sensitive secrets from the desktopify config.prod.json file and deploy unauthorized updates to any application using the affected ToDesktop infrastructure.

Critical Impact
Remote attackers could execute arbitrary commands on build servers, potentially compromising sensitive configuration secrets and enabling supply chain attacks through malicious app updates.

Affected Products

ToDesktop (versions before 2024-10-03)
Cursor (versions before 2024-10-03)
Other applications using ToDesktop build infrastructure

Discovery Timeline

2025-03-01 - CVE CVE-2025-27554 published to NVD
2025-03-01 - Last updated in NVD database

Technical Details for CVE-2025-27554

Vulnerability Analysis

This vulnerability is classified as CWE-94 (Improper Control of Generation of Code - Code Injection). The flaw exists in ToDesktop's build pipeline, which processes package.json files from application developers. When a build is triggered, ToDesktop's infrastructure executes npm lifecycle scripts, including postinstall hooks, without adequate sandboxing or validation.

An attacker with the ability to submit or modify a package.json file could inject malicious commands into the postinstall script section. When ToDesktop's build server processes this package, the injected commands execute with the privileges of the build process, granting access to sensitive build environment data.

The vulnerability has a changed scope, meaning successful exploitation affects resources beyond the vulnerable component itself—specifically, the entire build infrastructure and any applications deployed through it.

Root Cause

The root cause of CVE-2025-27554 lies in ToDesktop's build pipeline executing npm lifecycle scripts (postinstall) without proper isolation or sandboxing. The build server trusted the contents of package.json files without validating or restricting the commands that could be executed during the package installation phase. This trust model allowed arbitrary code execution in the context of the build environment.

Attack Vector

The attack vector is network-based and requires low privileges. An attacker could exploit this vulnerability by:

Crafting a malicious package.json file containing arbitrary shell commands in the postinstall script
Submitting this package to ToDesktop's build infrastructure
Upon build execution, the malicious postinstall script runs on the build server
The attacker gains access to sensitive files such as desktopify config.prod.json containing secrets
With these credentials, the attacker could potentially deploy malicious updates to any application using the ToDesktop platform

The vulnerability enables a supply chain attack scenario where a single compromised build could affect all downstream users of applications built with ToDesktop. According to the disclosure, no actual exploitation occurred before the vulnerability was patched.

Detection Methods for CVE-2025-27554

Indicators of Compromise

Unexpected or unauthorized postinstall scripts in package.json files submitted to build pipelines
Build server logs showing execution of suspicious commands during npm install phases
Unauthorized access attempts to desktopify config.prod.json or similar configuration files
Unexpected application updates or modifications to deployment artifacts

Detection Strategies

Monitor build pipeline logs for execution of shell commands during postinstall phases
Implement code review processes for all package.json modifications before build submission
Deploy file integrity monitoring on build server configuration files
Audit application updates for unexpected modifications or unsigned packages

Monitoring Recommendations

Enable verbose logging for all build pipeline activities
Set up alerts for access to sensitive configuration files on build servers
Monitor network traffic from build servers for unexpected outbound connections
Implement real-time monitoring of npm lifecycle script execution

How to Mitigate CVE-2025-27554

Immediate Actions Required

Update ToDesktop to a version released on or after 2024-10-03
Update Cursor to a version released on or after 2024-10-03
Audit all applications built with ToDesktop prior to the patch date
Rotate any secrets that may have been exposed through config.prod.json files
Review build logs for any suspicious postinstall script executions

Patch Information

ToDesktop released a security patch on 2024-10-03 that addresses this command injection vulnerability. Organizations should update to the latest version of ToDesktop and any dependent applications immediately. For detailed information about the incident and remediation steps, refer to the ToDesktop Security Incident Post. Additional technical analysis is available in the Kibty Blog Post.

Workarounds

Disable or remove postinstall scripts from package.json files before build submission until patches are applied
Implement network segmentation to isolate build servers from sensitive internal resources
Use containerized build environments with minimal privileges and no access to production secrets
Manually review all package.json files for suspicious lifecycle scripts before processing
Consider temporarily disabling automated builds until the patched version is deployed