T09 · Insecure Skill Coding Practices
Error
- Location
bin/memory.js:9- Finding
Shell Command Injection in Alternate CLI Launcher
- Content
View full analysis
{ // Properly escape arguments for Windows if (arg.includes(' ') || arg.includes('"')) { return `"${arg.replace(/"/g, '\\"')}"`; } return arg; }).join(' '); try { execSync(`node "${distPath}" ${args}`, { stdio: 'inherit', windowsHide: true }); ``` ### Technical Analysis The launcher concatenates user-controlled command-line arguments into a single string and passes that string to `execSync`. When `execSync` receives a string, Node.js executes it through the platform shell. The custom escaping only handles spaces and double quotes. It does not safely encode shell metacharacters such as: - `;`, `|`, `&`, `$()`, and backticks on POSIX shells - `&`, `|`, `^`, `%`, and redirection operators on Windows command interpreters Arguments without spaces or double quotes are inserted without any escaping. Quoting arguments with spaces also does not provide portable shell escaping. Consequently, an attacker who can influence an argument passed to this launcher may terminate or extend the intended command and execute an additional operating-system command. Although the current npm `bin` mapping points to `dist/index.js`, this alternate launcher remains directly executable and is explicitly implemented as a CLI entry point. ### Attack Path 1. A user, automation system, or Agent invokes `node bin/memory.js` with an attacker-influenced argument. 2. The launcher joins that argument into the `args` string. 3. The string is interpolated into ``node "${distPath}" ${args}``. 4. `execSync` submits the resulting string to the system shell. 5. The shell interprets embedded metacharacters and executes the injected command. A POSIX attack can have ...[truncated 754 chars]- Remediation
View remediation