CVE-2025-54314CWE-78

Thor before 1.4.0 can construct an unsafe shell command from library input

Low · published July 20, 2025

CVSS v3.1
2.8
EPSS
0%
Percentile
8.1
In the wild
Unconfirmed
What it is

Thor before 1.4.0 can construct an unsafe shell command from library input. NOTE: this is disputed by the Supplier because "the method that was fixed can only be used with arguments that are controlled by Thor, and there is no way an attacker can take control of those arguments."

The record
Technical detail
CVSS v3.1
2.8 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00189 · 8.1th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-07-20T00:00Z
EPSS history
Timeline
  • 20 JUL 00:00Z
    Thor before 1.4.0 can construct an unsafe shell command from library input
    cvelistv5