CVE-2022-24753 json
Code injection in Stripe CLI on windows
published 2022-03-09 4 y ago modified 2026-06-17 4 mo ago also GHSA-4cx6-fj7j-pjx9 , GO-2022-0350 , EUVD-2022-1304
- cvss
- 7.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 30%
- public exploits
- 0
- none known
Summary
Stripe CLI is a command-line tool for the Stripe eCommerce platform. A vulnerability in Stripe CLI exists on Windows when certain commands are run in a directory where an attacker has planted files. The commands are `stripe login`, `stripe config -e`, `stripe community`, and `stripe open`. MacOS and Linux are unaffected. An attacker who successfully exploits the vulnerability can run arbitrary code in the context of the current user. The update addresses the vulnerability by throwing an error in these situations before the code can run.Users are advised to upgrade to version 1.7.13. There are no known workarounds for this issue.
Patch / fix
- go github.com/stripe/stripe-cli 1.7.13
- stripe stripe_cli 1.7.13
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction
0.36% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.7 | CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.4 | AV:L/AC:M/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 7.7 | CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/stripe/stripe-cli | <1.7.13 |
1.7.13 |
Affected products
- stripe stripe-cli
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
github.com
/stripe/stripe-cli/commit/be38da5c0191adb77f661f769ffff2fbc7ddf6cd
web, patch, third-party-advisory
-
github.com
/stripe/stripe-cli/security/advisories/GHSA-4cx6-fj7j-pjx9
web, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-24753
advisory
-
github.com
/stripe/stripe-cli
package
Sources
- CVE List CVE-2022-24753
- GitHub Advisory GHSA-4cx6-fj7j-pjx9
- NVD CVE-2022-24753
- OSV GO-2022-0350
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.