T03 · Remote Payload Retrieval and Execution
Error
- Location
- assets/templates/PPT Template-level2/1.html:7
- Finding
- Mutable Remote JavaScript Is Executed Without Version Pinning or Integrity Verification<![CDATA[ ## Vulnerability Details **File Locations**: - `assets/templates/PPT Template-level2/1.html:7` - `assets/templates/PPT Template-level2/2.html:7` - `assets/templates/PPT Template-level2/3-1.html:7` - `assets/templates/PPT Template-level2/3-3.html:7` - `assets/templates/PPT Template-level2/4-1.html:7` - `assets/templates/PPT Template-level2/4-2.html:7` - `assets/templates/PPT Template-level2/4-3.html:7` - `assets/templates/PPT Template-level2/5-1.html:7` - `assets/templates/PPT Template-level2/5-2.html:7` - `assets/templates/PPT Template-level2/5-3.html:7` **Vulnerability Type**: Unverified remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code All affected templates contain the following active remote script: ```html <script src="https://unpkg.com/lucide@latest/dist/umd/lucide.min.js"></script> ``` ### Technical Analysis The templates load and execute JavaScript directly from `unpkg.com` whenever an affected presentation is opened. The dependency uses the mutable `@latest` version selector rather than an immutable, reviewed package version. Consequently, the JavaScript that executes is not necessarily the same code that existed when the Skill was audited. The templates also omit a Subresource Integrity hash, so the browser has no cryptographic mechanism to verify that the downloaded script matches an approved artifact. This creates an external code-execution channel. A malicious package release, compromised package-maintainer account, compromised CDN distribution path, or other upstream supply-chain incident could replace the expected icon-library payload with arbitrary JavaScript. Although this also represents an insecure dependency practice, the best matching classification is remote payload retrieval and execution because the templates directly execute a mutable external script at runtime. ### Attack Path 1. An attacker compromises the upstream Lucide package publication process, a package-maintainer account, or the ...[truncated 1645 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Prefer a bundled local dependency** - Download and review a specific Lucide release. - Store the approved JavaScript within the Skill package. - Reference it with a relative path so generated presentations do not execute mutable remote code. ```html <script src="../vendor/lucide-0.468.0.min.js"></script> ``` 2. **If remote hosting is unavoidable, pin an exact version** - Replace `@latest` with an immutable, explicitly reviewed release. - Do not use mutable version aliases or floating semantic-version ranges. ```html <script src="https://unpkg.com/lucide@0.468.0/dist/umd/lucide.min.js" crossorigin="anonymous"> </script> ``` 3. **Add Subresource Integrity** - Generate and independently verify the SHA-384 or SHA-512 digest of the exact approved artifact. - Add the resulting `integrity` attribute and retain `crossorigin="anonymous"`. ```html <script src="https://unpkg.com/lucide@0.468.0/dist/umd/lucide.min.js" integrity="sha384-REPLACE_WITH_VERIFIED_DIGEST" crossorigin="anonymous"> </script> ``` The placeholder must not be deployed; it must be replaced with the digest of the reviewed file. 4. **Apply a restrictive Content Security Policy** - Prefer `script-src 'self'` after bundling the dependency locally. - Avoid permitting broad CDN domains or unsafe script execution. - Restrict outbound connections with `connect-src` to reduce exfiltration opportunities. 5. **Update every affected template consistently** - Remediate all ten listed files rather than only the representative SARIF location. - Add an automated repository check that rejects remote scripts, `@latest`, unpinned versions, and external scripts without integrity metadata. 6. **Review generated output** - Verify that the generation and template-reconstruction workflow does not reintroduce remote scripts. - Consider producing fully self-contained HTML document ...[truncated 47 chars]