T09 · Insecure Skill Coding Practices
- Location
references/workflow.md:264- Finding
Chromium Sandbox Disabled While Rendering User-Derived HTML
- Content
View full analysis
Vulnerability Details
File Location:
references/workflow.md, lines 264-273
Vulnerability Type: Chromium browser sandbox disabled during HTML rendering
Risk Level: HighVulnerable Code
javascript const browser = await puppeteer.launch({ headless: 'new', executablePath: chromePath, args: ['--no-sandbox','--disable-setuid-sandbox','--disable-gpu'] });Technical Analysis
The screenshot workflow launches Chrome or Edge with both
--no-sandboxand--disable-setuid-sandbox. These options disable Chromium's principal process-isolation security boundary.The workflow renders locally generated HTML derived from user-provided articles or data. The documented HTML-generation process does not mandate context-aware escaping, removal of active HTML, blocking of event handlers, or a restrictive Content Security Policy. If attacker-controlled content is inserted into the generated document as markup rather than text, it may execute JavaScript during screenshot generation.
Disabling the sandbox does not itself grant administrative privileges, but it materially increases the consequences of malicious browser content or a browser exploit. A renderer compromise that would normally remain contained may gain access to the privileges of the account running the Skill.
The documentation states that these flags are technically necessary for headless execution, but headless Chromium normally supports sandboxed operation when the host is configured correctly. This explanation therefore does not eliminate the security risk.
Attack Path
- An attacker supplies article text or chart data containing active HTML, such as a script element, an event-handler attribute, or markup that initiates unauthorized network requests.
- The Skill incorporates that value into a generated chart HTML file without guaranteed context-aware escaping.
- The generated
screenshot.jsworkflow opens the local HTML file in Chromium through Puppeteer. - Chromium ...[truncated 1151 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
--no-sandboxand--disable-setuid-sandbox, and launch Chromium with its normal sandbox enabled. - Configure the runtime so sandboxed Chromium is supported. If that is impossible, fail safely or perform rendering inside a disposable, low-privilege container or virtual machine with no sensitive mounts or credentials.
- Apply context-aware HTML escaping to every user-derived title, label, source, description, and data value before inserting it into HTML or SVG.
- Insert user-provided values through safe text APIs such as
textContentrather thaninnerHTML. - Reject or sanitize script elements, event-handler attributes,
javascript:URLs, embedded frames, and other active content. - Add a restrictive Content Security Policy that disables scripts and plugins and permits network access only to explicitly required origins.
- Use Puppeteer request interception to block unexpected HTTP requests, navigation, downloads, and access to unapproved resources.
- Prefer locally bundled, integrity-verified fonts so chart rendering does not require external network access.
- Run the screenshot process under a dedicated, unprivileged account with access limited to the chart input directory and output directory.
- Keep Chrome or Edge patched and terminate rendering on navigation, certificate, timeout, or unexpected resource-loading errors.
- Remove