weather-cn-pro

• Analyzed: May 11, 2026, 6:40 AM
• Findings: 1
• Version: 1.0.0
• Hash: d50499c5403951e3a9739ea67c09feffb510973e366c6438cbbfe0dcdfed19cb
• Source: palm
• External report: View on VirusTotal

Findings (1)

The script `weather-cn-pro.sh` contains a potential command injection vulnerability by using `eval` on data parsed from an external website (weather.com.cn). While the current regex-based extraction provides some sanitization, using `eval` on remote content is a high-risk practice. Additionally, the script makes an unauthenticated request to a third-party API (`api.aooi.com`) for AQI data, which is an external dependency not explicitly mentioned in the primary description.