Vulnerability Description
Rejected reason: Bun Shell does not invoke /bin/sh, or any other interpreter, for template literals created with the $ function. Each ${…} interpolation is treated as a single argument. The security responsibility for this usage pattern lies with the calling application, which must ensure the sanitization and validation of any untrusted arguments before passing them to the executed commands. Therefore, the potential for command injection is not a flaw within Bun itself; rather, it is an argument injection that is contingent on its implementation by the consuming application.
FAQ
What is CVE-2025-8022?
CVE-2025-8022 is a documented vulnerability. Rejected reason: Bun Shell does not invoke /bin/sh, or any other interpreter, for template literals created with the $ function. Each ${…} interpolation is treated as a single argument. The security r...
How severe is CVE-2025-8022?
CVSS scoring is not yet available for CVE-2025-8022. Check NVD for updates.
Is there a patch for CVE-2025-8022?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.