Fix Shell Injection and Temporary File Injection in plugins/plugin-shell Module

Vulnerability Overview Vulnerability Name: C-1/C-2 unsafe-shell Cargo gate + allowlist-only Vulnerability Description: This vulnerability involves injection via metacharacters for C-1 (shell injection) and C-2 (run_python temporary file artifacts via stdin). Both vulnerabilities are located in the same module and are fixed in a single commit. Impact Scope Affected Module: Affected Versions: All versions with the feature enabled Fix Solution 1. New Cargo Feature: Added a new feature, disabled by default. When disabled, shell and Python execution code paths are not compiled into the binary; public methods are compiled as stubs that return clear error messages. 2. Replace BLOCKED_PATTERNS: Replaced the substring blacklist with a strict allowlist, permitting only comments from the first token of the parser. 3. Simplified Command Wrapping: Removed the command wrapper; commands are now executed directly via . Metacharacters have no special meaning to the OS, so shell involvement is unnecessary. 4. Updated run_python: now uses via stdin (no disk script artifacts) and sets on the subprocess, isolating , , 1 MiB output limit and streams, and . 5. Sandbox Mode: remains as a startup switch; (with default empty ) is disabled at compile time and can be reloaded at runtime via / . 6. Dependency Update: Updated dependencies in , including and . POC Code No specific POC code or exploit code is included in the page. Summary This commit fixes two security vulnerabilities in the module by introducing a new Cargo feature, replacing the blacklist with an allowlist, simplifying command execution paths, updating dependencies, and enhancing overall security.

Goal Reached Thanks to every supporter — we hit 100%!

Fix Shell Injection and Temporary File Injection in plugins/plugin-shell Module

More from this source