Security vulnerabilities and automated fixes for grpc issues
4 posts found
A high-severity shell injection vulnerability was discovered in `src/RtlJaguarDevice.cpp`, where user-controlled values from API responses were directly interpolated into gRPCurl command strings without proper shell escaping. An attacker who controls API response data could inject shell metacharacters, causing arbitrary command execution when a user pastes and runs the generated command. The fix applies proper shell escaping to all user-controlled values before they are included in command strin
A high-severity shell injection vulnerability was discovered and patched in a distributed server's gRPCurl command generation logic, where user-controlled values from API responses were directly interpolated into shell command strings without proper escaping. An attacker who can influence API response data — such as headers, endpoints, or payloads — could inject shell metacharacters that execute arbitrary commands when a user pastes and runs the generated command. This fix eliminates the risk by
A high-severity shell injection vulnerability was discovered and fixed in the HeadUnit Revived Android project, where user-controlled API response values were unsafely interpolated into gRPCurl command strings. An attacker could craft malicious headers, endpoints, or data payloads containing shell metacharacters that, when the generated command is pasted and executed, would run arbitrary commands on the victim's machine. The fix introduces proper shell escaping and broadcast intent protection to
A critical stack buffer overflow vulnerability was discovered in the ik-llama-cpp gRPC inference server, where three unguarded sprintf() calls wrote formatted statistics into fixed-size stack buffers without any length restrictions. If exploited, an attacker could overwrite return addresses and saved frame pointers, potentially achieving arbitrary code execution on the server. The fix replaces the unsafe sprintf() calls with length-aware alternatives, closing the door on this dangerous memory co