CVE-2022-25855: create-choo-app3 is vulnerable to Command Injection via the devInstall function

February 6, 2023 (updated March 25, 2025)

All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization.

References

github.com/advisories/GHSA-rj7m-2p3g-fjxg
github.com/choojs/create-choo-app
nvd.nist.gov/vuln/detail/CVE-2022-25855
security.snyk.io/vuln/SNYK-JS-CREATECHOOAPP3-3157951

Code Behaviors & Features

Detect and mitigate CVE-2022-25855 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →