Security Digest: December 11, 2025 - 2 Critical Vulnerabilities

Today, two high-severity vulnerabilities have been identified in popular software tools. CVE-2025-67508 affects Gardenctl when used with non-POSIX shells, potentially leading to arbitrary command execution.

· 3 min read

Urgent: Critical Vulnerabilities Discovered in Gardenctl and React Server Components

Executive Summary

Today, two high-severity vulnerabilities have been identified in popular software tools. CVE-2025-67508 affects Gardenctl when used with non-POSIX shells, potentially leading to arbitrary command execution. CVE-2025-55184 affects React Server Components, causing potential denial of service. Immediate updates are required to protect your systems.

Critical Vulnerabilities

CVE-2025-67508: Arbitrary Command Execution via Gardenctl

  • Impact: Attackers can execute arbitrary commands on operator devices using malicious infrastructure Secret objects.
  • Affected Systems: Gardenctl versions < v2.12.0 used with Fish or PowerShell.
  • Immediate Action: Update to gardenctl v2.12.0 or later immediately.
  • Mitigation: Ensure all operators use POSIX-compliant shells until the update is applied.

CVE-2025-55184: Denial of Service in React Server Components

  • Impact: Vulnerability allows denial of service attacks on affected React Server Component setups.
  • Affected Systems: Versions 19.0.0 - 19.2.1 of react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack.
  • Immediate Action: Upgrade to versions 19.0.2, 19.1.3, or 19.2.2 immediately.
  • Mitigation: Ensure your application does not use affected server components or apply the patches promptly.

What to Do Now

  1. Verify if systems are running vulnerable versions of Gardenctl and React Server Components.
  2. Apply the necessary updates to Gardenctl and React Server Components as specified.
  3. Monitor networks for unusual activities that may indicate exploitation attempts.

Related Resources

Keep reading