Description
ngrok v4.3.3 and 5.0.0-beta.2 is vulnerable to Command Injection.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | ngrok | 4.3.3 | — | GHSA-qr28-p3wr-mxq3 |
| npm | ngrok | 5.0.0-beta.2 | — | GHSA-qr28-p3wr-mxq3 |
High · 8.8
CVE-2025-57282
EUVD-2025-209888GHSA-qr28-p3wr-mxq3
ngrok is Vulnerable to Command Injection
Published May 18, 2026 · Updated May 18, 2026 · Assigned by mitre