GOG Stale Game Cleanup

• Analyzed: May 4, 2026, 2:21 AM
• Findings: 1
• Version: 1.0.0
• Hash: 29129d665b584ed0b6ad23de0b33a9a8ce095176042b19c47524b96a83602340
• Source: palm
• External report: View on VirusTotal

Findings (1)

The script `scripts/stale_games.sh` contains multiple code injection vulnerabilities where environment variables (`GOG_LIBRARY` and `REMINDERS_LIST`) are directly interpolated into Python strings within a `python3 -c` command. This allows for arbitrary Python code execution if these variables contain malicious payloads (e.g., single quotes followed by Python commands). While the tool's stated purpose of managing GOG games and sending reports via `himalaya` is plausible, the lack of input sanitization is a significant security flaw.