Executive brief
Bun is a popular JavaScript runtime that includes a shell API (the $ function) for running system commands from within code. The API fails to properly validate user-supplied input before passing it to system commands, allowing attackers to inject malicious command-line flags. For example, an attacker could supply `--upload-pack=env>hello;` instead of a legitimate repository URL, causing the git command to execute unintended actions. This could allow an attacker to modify the behavior of any shell command invoked through Bun's $ API if the application passes untrusted user input without sanitization.
Technical details
The vulnerability is an argument injection flaw in Bun's $ shell API (CWE-78). The root cause is that user-supplied input passed as template literal interpolations (${…}) to the $ function is not validated or escaped before being passed as command arguments to spawned processes. Although Bun does not invoke /bin/sh and treats each interpolation as a separate argument, an attacker can provide strings prefixed with `--` that the target command interprets as option flags rather than data arguments. This allows the attacker to inject arbitrary command-line options. The attack requires the calling application to pass untrusted user input directly to the $ API without sanitization. A proof-of-concept demonstrates that `git ls-remote --upload-pack=env>hello; main` can be exploited to execute arbitrary commands. The vulnerability affects all versions up to and including bun 1.1.39; patch availability is not explicitly confirmed in the advisory.
Affected products
- Oven bun <=1.1.39
Timeline
- 2025-03-23: disclosed
- 2025-07-23: advisory: Published as GHSA-4j66-8f4r-3pjx with CVE-2025-8022