Arbitrary Command Injection Affecting nitro-tpm-pcr-compute package, versions <1.1.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Arbitrary Command Injection vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-RUST-NITROTPMPCRCOMPUTE-14220399
- published14 Dec 2025
- disclosed5 Dec 2025
- creditAlexander Graf
Introduced: 5 Dec 2025
CVE NOT AVAILABLE CWE-77 (opens in a new tab)How to fix?
Upgrade nitro-tpm-pcr-compute to version 1.1.0 or higher.
Overview
Affected versions of this package are vulnerable to Arbitrary Command Injection via UefiData. An account operator with the ability to modify UefiData can alter kernel command line parameters and potentially bypass root filesystem integrity validation by modifying boot variables if PCR12 validation is not enforced in KMS policies. This is only exploitable if UEFI Secure Boot is disabled and KMS policies do not validate PCR12 or PCR7.
Workaround
This vulnerability can be mitigated by manually adding PCR12 with a static zero value to AWS KMS key policies or by enabling and validating UEFI Secure Boot.