CVE-2022-24753 - CVE House

Back to Database

Status published High CVE-2022-24753

Code injection in Stripe CLI on windows

7.7 CVSS

Vulnerability Description

Stripe CLI is a command-line tool for the Stripe eCommerce platform. A vulnerability in Stripe CLI exists on Windows when certain commands are run in a directory where an attacker has planted files. The commands are `stripe login`, `stripe config -e`, `stripe community`, and `stripe open`. MacOS and Linux are unaffected. An attacker who successfully exploits the vulnerability can run arbitrary code in the context of the current user. The update addresses the vulnerability by throwing an error in these situations before the code can run.Users are advised to upgrade to version 1.7.13. There are no known workarounds for this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-24753

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from stripe

View All →

stripe-cli Path Traversal vulnerability

Smokescreen SSRF via deny list bypass (square brackets) in Smokescreen

Smokescreen SSRF via deny list bypass

Vulnerability in Stripe for Visual Studio Code < 1.7.3

The Stripe API v1 allows remote attackers to bypass intended...

Affected Vendor

stripe

View all reports →

Affected Software

stripe-cli

Vulnerable Versions:

< 1.7.13

Timeline

Official Publish: March 9th, 2022

Last Modified: April 23rd, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1005 Data from Local System

T1041 Exfiltration Over C2 Channel