Security vulnerabilities and automated fixes for application security issues
2 posts found
A critical command injection vulnerability was discovered in app.js where the `exec()` function was used to run system commands with shell interpolation enabled. This allowed potential attackers to inject malicious commands through manipulated input. The fix replaces `exec()` with `execFile()`, which bypasses shell parsing entirely and executes binaries directly.
A critical command injection vulnerability was discovered in the `open_directory` method of `src/jm_view_server/app.py`, where user-controlled path input was passed directly into a shell command via `subprocess.Popen`. By switching from string-based shell execution to a list-based argument format, the fix eliminates the ability for attackers to inject malicious shell commands through crafted directory paths.