Security vulnerabilities and automated fixes for semgrep issues
43 posts found
A high-severity command injection risk was discovered in `npm/holidaytw/lib/installer.js` where the `verifyBinaryExecutes` function passed a user-influenced `binPath` argument directly to `spawnSync` without sanitization. The fix replaces `spawnSync` with `execFileSync` combined with `path.resolve()` and explicit `shell: false`, eliminating the shell interpretation attack surface. This proactive hardening raises the bar against automated exploit-chaining tools even in local CLI contexts.
A high-severity command injection vulnerability was identified in `src/node/util.ts`, where calls to Node.js's `child_process` module used a function argument `file` without sufficient input validation. If an attacker could control this input, they could execute arbitrary system commands on the server. The fix addresses the risk by tightening the dependency update pipeline via a Dependabot cooldown, reducing the attack surface from potentially malicious or compromised upstream packages.
A high-severity path traversal vulnerability was discovered in `xkeen-ui/routes/cores_status.py` at line 221, where user-controlled input was passed directly to Python's `open()` function without sanitization. An attacker could exploit this to read arbitrary files on the server by supplying crafted path strings like `../../etc/passwd`. The fix introduces strict path validation using a trusted root directory, ensuring only files within the intended directory can be accessed.
A high-severity command injection vulnerability was discovered in `js/cu_linux_executor.js`, where `child_process.execSync()` was used to run shell commands with potentially unsanitized input. The fix replaces shell-based execution with `execFileSync()`, which spawns processes directly without invoking a shell, eliminating the possibility of shell metacharacter injection. This change is a critical defensive hardening step that removes an exploit primitive that could be chained with other weaknes
A high-severity command injection vulnerability was discovered in `bin/git-commands.js`, where the `exec()` function from Node.js's `child_process` module was used to construct shell commands by directly interpolating arguments like branch names and file paths into template strings. The fix replaces `exec()` with `execFile()` and passes arguments as discrete array elements, eliminating the shell entirely and preventing any injected shell metacharacters from being interpreted. This is a critical
A high-severity command injection risk was discovered in `bench/src/grade.js` where a `child_process` call was made without explicitly disabling shell interpretation. By adding `shell: false` to the `spawnSync` options, the fix ensures that user-controlled input passed as the `task` argument cannot be weaponized to execute arbitrary shell commands. This proactive hardening raises the bar against automated exploit-chaining tools that target Node.js libraries.
A path traversal vulnerability in `scripts/merge_m3u.py` allowed user-influenced file paths returned by `glob.glob()` to escape the intended `custom/` directory boundary, potentially exposing arbitrary files on the system. The fix adds a `os.path.realpath()` check that filters out any resolved path that falls outside the expected directory. This is a proactive hardening measure that removes an exploit primitive before it can be chained with other weaknesses.
A high-severity command injection vulnerability was discovered in `tools/js/extractPcEntityMetadata.js`, where a `version` parameter was interpolated directly into a shell command string passed to `cp.execSync()`. By replacing the shell-invoking `execSync` with `execFileSync` and passing arguments as an array, the fix eliminates the shell entirely, making it impossible for a malicious `version` value to inject arbitrary commands.
A high-severity command injection risk was discovered in `src/cli.js` of a Node.js CLI tool, where `spawnSync` was called without explicitly disabling shell interpretation. By adding `shell: false` to the `spawnSync` options, the fix ensures that the `command` argument cannot be used to inject arbitrary shell commands, closing an exploit primitive that could be chained with other weaknesses.
A command injection vulnerability was discovered in `scripts/check-publish-status.js` where the `version` parameter was interpolated directly into shell commands via `execSync`. By switching to `execFileSync` with argument arrays, the fix eliminates shell interpretation entirely, preventing any attacker-controlled input from being executed as shell commands.
A medium-severity XML External Entity (XXE) vulnerability was discovered in `listKeyboardLayouts.py`, where Python's native `xml.etree.ElementTree` library was used to parse XML data. This library is susceptible to XXE attacks, which can allow attackers to read local files, perform server-side request forgery, or cause denial of service. The fix replaces the unsafe import with `defusedxml.ElementTree`, a drop-in hardened alternative recommended by the Python documentation itself.
A high-severity buffer overflow risk was discovered in `login/main.c` where `strcpy()` was used to copy the `HOME` environment variable into a fixed-size 512-byte buffer without any bounds checking. An attacker controlling the `HOME` environment variable could overflow `pwd_file_name`, potentially corrupting memory or hijacking execution. The fix replaces the two-step `strcpy`/`strcat` pattern with a single, bounds-safe `snprintf` call.