CVE-2025-57285: Codecept CodeceptJS RCE Vulnerability

CVE-2025-57285 Overview

CVE-2025-57285 is a critical command injection vulnerability affecting CodeceptJS version 3.7.3, a popular end-to-end testing framework for Node.js applications. The vulnerability exists in the emptyFolder function within lib/utils.js, where the execSync command directly concatenates a user-controlled directoryPath parameter without proper sanitization or escaping. This allows attackers to inject and execute arbitrary system commands on the underlying server.

Critical Impact

Attackers can achieve full remote code execution by crafting malicious input to the emptyFolder function, potentially leading to complete system compromise, data exfiltration, or lateral movement within the network.

Affected Products

• CodeceptJS version 3.7.3 for Node.js
• Applications utilizing the vulnerable emptyFolder utility function
• Test automation pipelines with exposed CodeceptJS configurations

Discovery Timeline

• 2025-09-08 - CVE-2025-57285 published to NVD
• 2025-09-12 - Last updated in NVD database

Technical Details for CVE-2025-57285

Vulnerability Analysis

This command injection vulnerability (CWE-77) represents a fundamental security flaw in how CodeceptJS handles user-supplied input when performing file system operations. The emptyFolder function in lib/utils.js uses Node.js's execSync method to execute shell commands for directory manipulation. Instead of using secure APIs or properly sanitizing the directoryPath parameter, the function directly concatenates this value into the command string.

The vulnerability is particularly dangerous because it requires no authentication and can be exploited over the network when CodeceptJS is exposed through web interfaces, CI/CD pipelines, or test automation frameworks that accept external input. An attacker who can control the directory path parameter can break out of the intended command context and execute arbitrary commands with the same privileges as the Node.js process.

Root Cause

The root cause of this vulnerability is the insecure use of execSync with unsanitized user input. The emptyFolder function fails to implement proper input validation, sanitization, or use of parameterized command execution. By directly concatenating the directoryPath parameter into a shell command string, the function creates a classic command injection vector. Proper mitigation would require either sanitizing the input to remove shell metacharacters, using safer file system APIs like fs.rm() with recursive options, or employing libraries designed to safely handle shell arguments.

Attack Vector

The attack vector is network-based, requiring no privileges or user interaction for exploitation. An attacker can inject malicious shell metacharacters (such as ;, |, &&, or backticks) into the directoryPath parameter to escape the intended command context. For example, providing a path like /tmp; cat /etc/passwd would cause the application to first execute the intended operation and then execute the injected cat command, exposing sensitive system files.

The vulnerability can be exploited in various scenarios including:

• Test automation systems that accept directory paths from external sources
• CI/CD pipelines where CodeceptJS processes user-controlled configuration
• Web applications that expose CodeceptJS functionality through APIs

Technical details and example code demonstrating this vulnerability can be found in the GitHub Gist security research. The vulnerability allows for complete system compromise when the application runs with elevated privileges.

Detection Methods for CVE-2025-57285

Indicators of Compromise

• Unexpected child process spawning from Node.js applications using CodeceptJS
• Unusual command execution patterns in system logs originating from the application user context
• Network connections to external hosts initiated by the Node.js process
• Modification of system files or creation of new user accounts correlated with CodeceptJS execution

Detection Strategies

• Monitor application logs for directory path parameters containing shell metacharacters (;, |, &&, $(), backticks)
• Implement runtime application self-protection (RASP) to detect command injection attempts
• Deploy endpoint detection solutions to identify anomalous process trees spawned by Node.js
• Review CodeceptJS configuration files for hardcoded or externally-sourced directory paths

Monitoring Recommendations

• Enable verbose logging for CodeceptJS operations and review for suspicious directory path inputs
• Configure security information and event management (SIEM) rules to alert on command injection patterns
• Monitor process execution chains for unexpected commands spawned by Node.js workers
• Implement network egress monitoring to detect potential data exfiltration following exploitation

How to Mitigate CVE-2025-57285

Immediate Actions Required

• Audit all CodeceptJS implementations to identify exposure of the emptyFolder function to user-controlled input
• Implement strict input validation on any directory path parameters before passing to CodeceptJS functions
• Consider replacing emptyFolder usage with secure alternatives using native Node.js fs module functions
• Isolate test automation environments from production systems and limit network access

Patch Information

As of the last update on 2025-09-12, users should check the NPM Package Registry for the latest CodeceptJS version that addresses this vulnerability. Monitor the official CodeceptJS repository and security advisories for patch releases. Until a patch is available, implement the workarounds described below.

Workarounds

• Replace emptyFolder function calls with native Node.js fs.rm(path, { recursive: true, force: true }) operations
• Implement a whitelist of allowed directory paths and reject any input not matching the whitelist
• Use a wrapper function that sanitizes directory path input by removing or escaping shell metacharacters
• Run CodeceptJS in a sandboxed environment with minimal system privileges and restricted network access

# Example: Restricting CodeceptJS process permissions
# Run with reduced privileges and restricted file system access
node --experimental-permission --allow-fs-read=/app/tests --allow-fs-write=/app/output codecept.run.js

# Alternative: Use containerization with limited capabilities
docker run --read-only --cap-drop=ALL --security-opt=no-new-privileges codeceptjs-tests