MiniMax Vision Captcha

• Analyzed: May 11, 2026, 5:06 AM
• Findings: 1
• Version: 1.0.0
• Hash: 1d5a9337b0858ae5b2a969b6396c5dcc1b612b6a040532ca64d26bf066868984
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `scripts/solve-captcha.js` file contains a shell injection vulnerability. User-controlled inputs (`prompt` and `imagePath`) are directly interpolated into a command string executed via `child_process.execSync` without proper sanitization or escaping. This allows an attacker to execute arbitrary commands by crafting the `--prompt` or `--image` arguments, posing a significant remote code execution risk. This is a vulnerability rather than intentional malice.