Security vulnerabilities and automated fixes for cli security issues
10 posts found
A Node.js CLI script in `scripts/refresh-htv-signature.js` accepted a user-controlled `slug` argument from `process.argv` and interpolated it directly into a URL string without any validation. While the immediate usage was an HTTP request via `axios.get()`, the absence of input sanitization created a pathway for command injection in current and future code paths. The fix adds a strict allowlist regex that rejects any slug not matching `[a-zA-Z0-9_-]+` before it can reach any downstream operation
A path traversal vulnerability in `scripts/diff-docx.js` allowed attackers to supply crafted `--output` arguments containing `../` sequences, enabling arbitrary file writes outside the intended working directory. The fix uses `path.resolve()` combined with a working-directory boundary check to ensure all output paths stay within safe bounds. This matters because the script is part of a Node.js library, meaning every downstream consumer was exposed to the same risk.
A path traversal vulnerability in `tools/shot.mjs` allowed attackers to supply a malicious file path as a CLI argument, causing Playwright's `screenshot()` method to write files to arbitrary filesystem locations — including sensitive system directories. The fix introduces a new `safepath.mjs` module that resolves and validates every output path against the project root before any file is written.
A high-severity command injection risk was discovered in `src/cli.js` of a Node.js CLI tool, where `spawnSync` was called without explicitly disabling shell interpretation. By adding `shell: false` to the `spawnSync` options, the fix ensures that the `command` argument cannot be used to inject arbitrary shell commands, closing an exploit primitive that could be chained with other weaknesses.
A critical input validation vulnerability was discovered in `bin/vibe-to-ui.js` where command-line arguments from `process.argv` were reflected directly into error messages without sanitization. This defensive gap could allow attackers controlling CLI arguments—via CI/CD pipelines, wrapper scripts, or compromised environments—to inject malicious content. The fix introduces a strict allowlist regex and length cap to neutralize dangerous characters before any argument is used.
A critical Server-Side Request Forgery (SSRF) vulnerability in the compass-guarded-transfer CLI tool allowed attackers to make HTTP requests to internal services and cloud metadata endpoints. The `normalizeInput` function in `run-transfer.mjs` validated that URLs started with "https://" but failed to prevent requests to private IP ranges like AWS metadata (169.254.169.254) or localhost, enabling potential credential theft and internal network reconnaissance.
A critical command injection vulnerability was discovered in `packages/core/bin/cli.js` where the `copyToClipboard` function used `execSync()` with shell command strings. Combined with insufficient filename sanitization in the cache functions, an attacker could inject arbitrary shell commands through malicious repository data containing shell metacharacters. The fix replaces `execSync()` with `execFileSync()` and tightens input sanitization on cache file paths.
A critical credential exposure vulnerability was discovered in `cli/src/utils/github.ts`, where three GitHub API fetch calls were made without any safe token-loading mechanism, risking accidental hardcoding or token leakage in logs and CI/CD pipelines. The fix introduces a centralized `getAuthHeaders()` function that reads the token exclusively from the `GITHUB_TOKEN` environment variable and safely injects it into all outbound API requests. This ensures credentials never touch source code, buil
A medium-severity vulnerability in `tools/cli/aroma.py` allowed keystore passwords entered via the `get_input()` function to be displayed in plaintext on the terminal, stored unmasked in memory, and potentially recorded in shell history files. The fix introduces Python's `getpass` module and a new `secret` parameter to `get_input()`, ensuring sensitive credential input is properly masked during entry. This change directly protects users of the CLI tool from credential exposure during routine key
A critical buffer overflow vulnerability was discovered and patched in the linenoise.c input library used by the ds4 CLI tool, where unchecked memcpy operations could allow attackers to overwrite adjacent memory regions. The fix adds proper bounds checking before memory copy operations, preventing potential heap and stack corruption. This vulnerability serves as a timely reminder of why input validation and buffer size verification remain essential disciplines in C programming.