T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup.py:324- Finding
Arbitrary Python Code Execution Through the Configurable Model Identifier
- Content
View full analysis
None: """Download the Kokoro model by doing a test load (MLX).""" print_step(f"Downloading model: {model_name}...") python = os.path.join(venv_path, "bin", "python3") result = subprocess.run([ python, "-c", f"from mlx_audio.tts.utils import load_model; m = load_model(model_path='{model_name}'); print('Model loaded, sample_rate:', getattr(m, 'sample_rate', 24000))" ], capture_output=True, text=True, timeout=300) ``` The model value is obtained from configuration when setup invokes this function: ```python # scripts/setup.py:477-480 if engine == "mlx": download_model_mlx(venv_path, config.get("model", "mlx-community/Kokoro-82M-bf16")) else: download_model_pytorch(venv_path) ``` The documented configuration command permits an unrestricted string to be written: ```python # scripts/config.py:276-279 def cmd_set(key: str, value: str) -> None: """Set a config value.""" config = load_config() set_value(config, key, value) save_config(config) ``` ### Technical Analysis The `model_name` configuration value is interpolated directly into Python source code passed to a separate interpreter through the `-c` option. It is placed inside a single-quoted Python string without escaping or validation. An attacker-controlled value containing a single quote, closing parenthesis, statement separator, and comment marker can terminate the intended `load_model()` call and insert arbitrary Python statements. For example, a value conceptually shaped as: ```text x'); __import__('os').system('ATTACKER_COMMAND'); # ``` would transform the generated source into c ...[truncated 1930 chars]- Remediation
View remediation