CVE-2025-64726

Socket Firewall is an HTTP/HTTPS proxy server that intercepts package manager requests and enforces security policies by blocking dangerous packages. Socket Firewall binary versions (separate from installers) prior to 0.15.5 are vulnerable to arbitrary code execution when run in untrusted project directories. The vulnerability allows an attacker to execute arbitrary code by placing a malicious .sfw.config file in a project directory. When a developer runs Socket Firewall commands (e.g., sfw npm install) in that directory, the tool loads the .sfw.config file and populates environment variables directly into the Node.js process. An attacker can exploit this by setting NODE_OPTIONS with a --require directive to execute malicious JavaScript code before Socket Firewall's security controls are initialized, effectively bypassing the tool's malicious package detection. The attack vector is indirect and requires a developer to install dependencies for an untrusted project and execute a command within the context of the untrusted project. The vulnerability has been patched in Socket Firewall version 0.15.5. Users should upgrade to version 0.15.5 or later. The fix isolates configuration file values from subprocess environments. Look at sfw --version for version information. If users rely on the recommended installation mechanism (e.g. global installation via npm install -g sfw) then no workaround is necessary. This wrapper package automatically ensures that users are running the latest version of Socket Firewall. Users who have manually installed the binary and cannot immediately upgrade should avoid running Socket Firewall in untrusted project directories. Before running Socket Firewall in any new project, inspect .sfw.config and .env.local files for suspicious NODE_OPTIONS or other environment variable definitions that reference local files.