Security vulnerabilities and automated fixes for build scripts issues
4 posts found
A critical command injection vulnerability in `scripts/sync-skill.mjs` allowed attackers to execute arbitrary commands through malicious command-line arguments. The fix implements strict whitelist validation on `process.argv` inputs, ensuring only the `--check` flag is accepted before any shell interaction occurs.
A high-severity command injection vulnerability was discovered in the `scripts/build.cjs` file where `cp.exec()` was used to execute commands from a function argument. This pattern could allow attackers to inject malicious shell commands if the input were ever user-controllable. The fix replaced `cp.exec()` with `cp.execFile()`, eliminating the shell interpretation that makes command injection possible.
A critical path traversal vulnerability in `scripts/build-all.js` allowed attackers to escape the intended output directory by supplying crafted command-line arguments like `--output ../../../../etc/passwd`. The fix validates that the resolved output path remains within the repository root, preventing unauthorized file system access.
A critical supply chain vulnerability in the chatgpt-auto-continue extension's build utility allowed arbitrary code execution by fetching JavaScript from a CDN without integrity verification. The fix implements SHA-256 hash validation before executing the downloaded code, preventing potential supply chain attacks through compromised CDN content or man-in-the-middle attacks.