CVE-2025-48069: ejson2env Command Injection Vulnerability

CVE-2025-48069 Overview

CVE-2025-48069 affects ejson2env, a Shopify-maintained tool that decrypts EJSON secrets and exports them as environment variables. Versions prior to 2.0.8 fail to sanitize output written to stdout. Attackers who control variable names or values in EJSON files can inject shell metacharacters that produce additional unintended commands. When the tool's output is piped into eval or executed by a shell, arbitrary command execution occurs on the host. The vulnerability is classified under [CWE-78] (OS Command Injection). Shopify released version 2.0.8 to sanitize output during decryption.

Critical Impact

An attacker able to influence EJSON secret contents can inject shell commands that execute when ejson2env output is evaluated, leading to arbitrary command execution in the calling context.

Affected Products

• Shopify ejson2env versions prior to 2.0.8
• CI/CD pipelines that shell-evaluate ejson2env output
• Any tooling that sources unsanitized ejson2env stdout into a shell session

Discovery Timeline

• 2025-05-21 - CVE-2025-48069 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48069

Vulnerability Analysis

ejson2env reads decrypted EJSON key-value pairs and prints shell export statements. The pre-2.0.8 implementation relied on regular expressions (exportCommandPattern and quietCommandPattern) to validate output formatting but did not escape shell metacharacters or nonprintable characters inside variable values. Because operators typically pipe the output into eval or source, any injected newline, semicolon, or subshell sequence becomes an executable command in the current shell context.

The patch replaces the regex validation approach with the shellescape library, which quotes each exported value using POSIX shell escaping rules. This ensures that secret values are treated as opaque strings regardless of embedded metacharacters.

Root Cause

The root cause is inadequate output sanitization during the encoding step of shell export statements. Variable values were interpolated directly into the export KEY=VALUE template without escaping shell-significant characters such as ;, `, $(, and newlines. Regex-based validation acted only as a format check, not as a defense against injection.

Attack Vector

Exploitation requires an attacker to control or influence content stored in an EJSON secret file consumed by ejson2env. The attack succeeds when downstream tooling executes the tool's output through a shell interpreter. In shared CI/CD environments where multiple parties can commit changes to secret files, a malicious contributor can plant a payload that runs during deployment.

// Patch: exportfunctions.go - replaces regex validation with shell escaping
import (
    "fmt"
    "io"
    "os"
    "sort"
    "strings"
    "unicode"

    "al.essio.dev/pkg/shellescape"
)

// Removed pre-patch validation:
// var exportCommandPattern = regexp.MustCompile(`^export [a-zA-Z_][a-zA-Z0-9_-]*=([A-Za-z0-9/:=-]+|'.*')$`)
// var quietCommandPattern  = regexp.MustCompile(`^[a-zA-Z_][a-zA-Z0-9_-]*=([A-Za-z0-9/:=-]+|'.*')$`)

// ExportEnv writes the passed environment values to the passed io.Writer.
func ExportEnv(w io.Writer, values map[string]string) {
    // values are now emitted through shellescape.Quote before being written
}

Source: GitHub commit 592b3ce

Detection Methods for CVE-2025-48069

Indicators of Compromise

• EJSON secret files containing shell metacharacters such as ;, `, $(, or embedded newlines inside values
• Unexpected child processes spawned by CI/CD runners immediately after ejson2env invocations
• Shell history or process telemetry showing commands that were not present in the pipeline definition

Detection Strategies

• Inventory build systems for ejson2env binaries and confirm the installed version is 2.0.8 or later
• Scan repository history for EJSON files containing suspicious value patterns using regex checks for control characters and shell operators
• Alert on eval or source constructs consuming the output of ejson2env in CI/CD job definitions

Monitoring Recommendations

• Collect process telemetry from CI/CD runners and correlate parent-child relationships involving ejson2env
• Monitor changes to EJSON secret files through version control audit logs and require code review for any modification
• Log the full command line and stdout of secret-handling tooling in ephemeral build environments

How to Mitigate CVE-2025-48069

Immediate Actions Required

• Upgrade ejson2env to version 2.0.8 or later across all developer workstations, build agents, and container images
• Audit CI/CD pipelines for use of eval or source on ejson2env output and restrict write access to EJSON secret files
• Rotate any secrets that may have been present in EJSON files modified by untrusted contributors

Patch Information

Shopify released version 2.0.8, which sanitizes output during decryption by routing values through the shellescape library. Details are available in the GitHub Security Advisory GHSA-2c47-m757-32g6 and the remediation commit.

Workarounds

• Avoid using ejson2env to decrypt secrets sourced from untrusted contributors
• Strip nonprintable and shell-significant characters from ejson2env output before passing it to eval or source
• Load environment variables using a parser that does not invoke a shell interpreter

# Verify installed version and upgrade
ejson2env --version
go install github.com/Shopify/ejson2env/v2@v2.0.8

# Safer invocation pattern: filter nonprintable characters before evaluating
eval "$(ejson2env secrets.ejson | tr -cd '[:print:]\n')"