Cyber Resilience

CVE-2025-57282

HighRCE

Published: 18 May 2026

Published
18 May 2026
Modified
18 May 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0098 57.9th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-57282 is a high-severity Command Injection (CWE-77) vulnerability in Npmjs (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 42.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability details

ngrok v4.3.3 and 5.0.0-beta.2 is vulnerable to Command Injection.

CWE(s)
CWE-77

Related Threats

CVEs Like This One

CVE-2026-22864Shared CWE-77
CVE-2024-57590Shared CWE-77
CVE-2026-21638Shared CWE-77
CVE-2025-64090Shared CWE-77
CVE-2025-55125Shared CWE-77
CVE-2024-57036Shared CWE-77
CVE-2026-26791Shared CWE-77
CVE-2025-60854Shared CWE-77
CVE-2024-57211Shared CWE-77
CVE-2024-52325Shared CWE-77

Affected Assets

Npmjs
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References