Security vulnerabilities and automated fixes for child process issues
6 posts found
An Electron application's `runStreaming()` utility accepted a command string and argument array without validating either, creating a latent command injection vector. The fix adds strict type checking and a whitelist regex that rejects shell metacharacters, bounding the failure mode even if caller input becomes attacker-influenced.
A high-severity command injection vulnerability was identified in `src/node/util.ts`, where calls to Node.js's `child_process` module used a function argument `file` without sufficient input validation. If an attacker could control this input, they could execute arbitrary system commands on the server. The fix addresses the risk by tightening the dependency update pipeline via a Dependabot cooldown, reducing the attack surface from potentially malicious or compromised upstream packages.
A high-severity command injection vulnerability was discovered in `scripts/pass.js` where git commands were constructed by interpolating unsanitized arguments directly into shell strings passed to `execSync()`. The fix replaces shell-string execution with `execFileSync()` using argument arrays, eliminating the shell interpolation layer entirely, and adds strict input validation for task names before they reach the filesystem or process spawning logic.
A high-severity command injection vulnerability was discovered in the `scripts/build.cjs` file where `cp.exec()` was used to execute commands from a function argument. This pattern could allow attackers to inject malicious shell commands if the input were ever user-controllable. The fix replaced `cp.exec()` with `cp.execFile()`, eliminating the shell interpretation that makes command injection possible.
A high-severity command injection vulnerability was discovered in `events/console/line.js` where user-controlled input was passed directly to `child_process.exec()`. The fix replaces the dangerous `exec()` function with the safer `execFile()` API, implements a strict whitelist of allowed commands, and adds comprehensive argument validation to prevent remote code execution.
A high-severity command injection vulnerability was discovered in `src/collectors/git.ts`, where `execSync` was used to build a shell command by interpolating unsanitized arguments into a template string. By replacing `execSync` with `spawnSync`, the fix eliminates shell interpretation entirely, ensuring that git arguments are passed directly to the process without ever touching a shell. This change is especially important for a Node.js library, where downstream consumers may pass user-controlle