Executive brief
Elysia is a web framework for building backend applications. When cookie validation is enabled with dynamic schemas, unsanitized cookie configuration (often sourced from environment variables) is directly injected into compiled route code, allowing attackers who control the configuration to execute arbitrary code on the server. This vulnerability becomes a complete remote code execution vector when combined with a prototype pollution flaw in the same framework.
Technical details
This is a code injection vulnerability (CWE-94) in Elysia's ahead-of-time (AOT) compiler. When a cookie schema is defined on a route and cookies are dynamically enabled, the framework injects the cookie configuration directly into generated code without sanitizing string values. An attacker with write access to the cookie configuration (typically via environment variables) can inject malicious code that executes during route compilation. The attack requires high privileges (write access to app config/environment) and is only exploitable when AOT compilation is enabled (the default). Patches are available in version 1.4.18 and later; a workaround exists to sanitize configuration strings by escaping template literals and variable references.
Affected products
- Elysia Elysia < 1.4.18
Timeline
- 2025-12-09: disclosed
- 2025-12-09: patched: Fixed in version 1.4.18