CVE-2022-25908

CVE-2022-25908 is a critical command injection vulnerability affecting all versions of the create-choo-electron package, stemming from insufficient sanitization of user input within the devInstall function. With a CVSS score of 9.8, this vulnerability is easily exploitable over the network with low attack complexity, allowing an unauthenticated attacker to achieve complete compromise of confidentiality, integrity, and availability. There is currently no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.