关键漏洞信息 漏洞标题 App reinitialization can be re-triggered allowing command injection in development mode (dev-only, fixed in 3.3.2) 影响范围 受影响版本: >=3.2.0, <3.3.2 修复版本: 3.3.2 漏洞描述 影响: Development mode only. Kottster contains a pre-authentication remote code execution (RCE) vulnerability when running in development mode. 问题结合: 1. The action can be called repeatedly without checking if the app is already initialized, allowing attackers to create a new root admin account and obtain a JWT token. 2. The action uses unescaped command arguments, enabling command injection. 攻击场景 Reinitialize the application and receive a JWT token for a new root account. Use this token to authenticate. Execute arbitrary system commands through . 生产环境影响 Production deployments were never affected. 修复措施 Fixed in v3.3.2. Specifically, and address this vulnerability. 解决方案 绕过方法 Do not expose development servers to public networks or untrusted users. Use production mode for any deployment accessible from outside trusted environments. 致谢 We sincerely thank Jeongwon Jo (@POcas) from RedAlert for discovering and responsibly disclosing this vulnerability. CVE ID CVE-2025-62713 弱点 CWE-284