CVE-2025-64726 Overview
CVE-2025-64726 is an arbitrary code execution vulnerability in Socket Firewall, an HTTP/HTTPS proxy that intercepts package manager requests to block dangerous packages. Socket Firewall binary versions prior to 0.15.5 load a project-local .sfw.config file and populate its values directly into the Node.js process environment. An attacker who controls a project directory can set NODE_OPTIONS with a --require directive, causing malicious JavaScript to execute before Socket Firewall's security controls initialize. Exploitation requires a developer to run a Socket Firewall command such as sfw npm install inside the attacker-controlled project.
Critical Impact
A malicious .sfw.config file bypasses Socket Firewall's package-blocking controls and executes arbitrary code in the developer's Node.js runtime.
Affected Products
- Socket Firewall binary versions prior to 0.15.5
- Manually installed sfw binaries not managed by the global npm wrapper
- Developer workstations running sfw commands in untrusted project directories
Discovery Timeline
- 2025-11-13 - CVE-2025-64726 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-64726
Vulnerability Analysis
Socket Firewall is designed to sit between a package manager and the network, blocking installation of malicious packages. The tool reads a per-project configuration file named .sfw.config when invoked in a project directory. Values from that file are written into the environment of the Node.js process that runs Socket Firewall itself, and are propagated to child processes such as npm. This behavior places an untrusted, attacker-controlled file in the same trust boundary as the security tool it configures. The result is arbitrary code execution [CWE-15: External Control of System or Configuration Setting] before any package-inspection logic runs.
Root Cause
The root cause is unsafe merging of configuration-file values into process and subprocess environments. Socket Firewall does not filter sensitive Node.js environment variables such as NODE_OPTIONS when loading .sfw.config. Node.js honors NODE_OPTIONS at interpreter startup, so any --require <path> directive causes the referenced JavaScript file to load before user code, including Socket Firewall's own security initialization. The fix in version 0.15.5 isolates configuration-file values from subprocess environments.
Attack Vector
Exploitation is local and indirect. An attacker publishes or shares a project repository containing a crafted .sfw.config file and, typically, a companion JavaScript payload referenced through NODE_OPTIONS=--require ./payload.js. When a developer clones the repository and runs a Socket Firewall command such as sfw npm install inside that directory, sfw reads .sfw.config, injects NODE_OPTIONS into the Node.js environment, and Node loads the attacker's payload before Socket Firewall enforces its malicious-package detection. The attacker then executes code with the developer's privileges, exfiltrates credentials, or tampers with subsequent installs. See the GitHub Security Advisory GHSA-6c5p-vqrh-h6fp for vendor-published detail.
Detection Methods for CVE-2025-64726
Indicators of Compromise
- Presence of .sfw.config or .env.local files in cloned or third-party project directories that define NODE_OPTIONS
- NODE_OPTIONS values containing --require, --import, or --experimental-loader directives pointing to local files inside the project
- Unexpected child processes spawned by sfw, node, or npm shortly after sfw invocations
- Outbound network connections from developer workstations initiated by node immediately after running sfw in a new repository
Detection Strategies
- Scan repositories and developer workstations for .sfw.config files and flag any that define environment variables beyond the documented Socket Firewall configuration keys
- Alert on process telemetry where node or sfw is invoked with a non-empty NODE_OPTIONS environment variable referencing files inside the current working directory
- Correlate sfw executions with sfw --version output to identify hosts still running versions below 0.15.5
Monitoring Recommendations
- Log command-line arguments and environment variables of node, npm, and sfw processes on developer endpoints
- Baseline expected Socket Firewall configuration keys and alert on additions such as NODE_OPTIONS, NODE_PATH, or loader-related variables
- Monitor for sfw execution in directories that were recently cloned from external sources
How to Mitigate CVE-2025-64726
Immediate Actions Required
- Upgrade Socket Firewall to version 0.15.5 or later and confirm with sfw --version
- Audit all developer workstations for manually installed sfw binaries and replace them with the npm-managed wrapper (npm install -g sfw), which auto-updates
- Inspect .sfw.config and .env.local files in any untrusted project before running sfw inside it
- Revoke and rotate any developer credentials that may have been exposed on hosts where sfw ran inside untrusted projects
Patch Information
The vulnerability is patched in Socket Firewall version 0.15.5. The fix isolates configuration-file values so they no longer propagate into subprocess environments, preventing NODE_OPTIONS and similar variables from reaching the Node.js runtime through .sfw.config. Users who installed via npm install -g sfw receive the fix automatically through the wrapper package. Refer to the GitHub Security Advisory GHSA-6c5p-vqrh-h6fp for release details.
Workarounds
- Avoid running sfw inside untrusted project directories until the binary is upgraded to 0.15.5 or later
- Manually inspect .sfw.config and .env.local for NODE_OPTIONS or other environment variable definitions that reference local files before executing any sfw command
- Prefer the recommended global installation path (npm install -g sfw), which ensures automatic updates and removes the need for a manual workaround
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
