mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-08-22 23:22:09 +03:00
64b8ffffc1
POST /api/acp/agents lets a client register a custom agent controlling both `binary` and `versionCommand`. The version probe runs execFileSync(binary, args); the binary-match check alone still admits an eval argument on a matching interpreter (`node -e …`, `python -c …`, `ruby -e …`), which is arbitrary code execution with no shell metacharacter. `/api/acp/agents` is already LOCAL_ONLY (#7948) so the remote/anonymous vector is closed, but a loopback/LAN caller with requireLogin=false — or any authenticated caller — could still reach the sink. resolveVersionProbe() now restricts untrusted (requireBinaryMatch) probes to a bare binary or a single recognized version flag, so no code-running argument can pass. Built-in agents (requireBinaryMatch=false) are unaffected. Reported by @c111mb3r via GHSA-jphr-2gw7-xrwp and GHSA-hf57-cqmx-p4gr.