The sqls utility version 0.2.28 contains a critical command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands on the host system.

This vulnerability occurs because the openEditor function unsafely passes the EDITOR environment variable and the configuration file path to the shell, enabling command injection for unauthenticated users.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands with the privileges of the user running the sqls utility. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to system integrity and confidentiality, potentially leading to full system compromise if the utility is executed by a high-privilege account.

Immediate Action: There is currently no official patch available; users should restrict access to the sqls utility and avoid setting the EDITOR environment variable to untrusted values.

Proactive Monitoring: Monitor system process logs for suspicious child processes spawned by sqls, particularly those executing shell commands like sh or bash.

Compensating Controls: Implement strict environment variable management and ensure the application runs with the least privilege necessary to limit the impact of a potential command injection.

Public Exploit Available: Yes, a published PoC exists, as documented in the linked research write-up (https://lukmanern.github.io/CVE-2025-61141.html).

Due to the lack of an official vendor patch and the availability of a public proof-of-concept, organizations should immediately audit their environments for the presence of sqls version 0.2.28. Users must exercise extreme caution with environment variables and restrict execution access until a formal update is released by the project maintainers.