Katriel Moses

Charmbracelet wish before 2.0.5 contains a path traversal vulnerability in the git middleware (charm.land/wish/v2) that allows authenticated SSH users to escape the configured repository directory by supplying crafted repo paths that bypass a flawed forward-slash-count containment check in git.Middleware(). Attackers can use a single-depth path ../evil, or on Windows a payload ....evil that defeats the slash-count guard entirely, to read or write arbitrary repositories outside the intended root via git-upload-pack, git-upload-archive, or git-receive-pack.

An open redirect exists in the OIDC initiation endpoint. Unauthenticated remote attackers can redirect authenticated users to external sites by injecting an unvalidated redirect query parameter. This allows attackers to craft malicious links targeting the OIDC callback flow to capture authorization codes through the Referer header, potentially leading to credential phishing against Dockhand accounts following a legitimate login.

An authentication bypass exists in the git webhook endpoints due to a null webhook secret guard condition. This allows unauthenticated remote attackers to trigger arbitrary stack redeployments by enumerating sequential stack IDs and sending unsigned webhook requests to force git clone and docker compose operations. This can lead to a denial of service or, if the attacker has write access to the tracked git branch, result in container escape and full host compromise through a malicious `docker-compose.yml` file utilizing privileged bind mounts.

On macOS, a command injection issue exists when a crafted URL containing shell metacharacters is supplied to the `server.open` configuration. The `openBrowser()` function in `packages/core/src/server/open.ts` processes the URL using `encodeURI()` before interpolating it into a shell command executed via `child process.exec()`. Since `encodeURI()` does not encode semicolons, parentheses, or dollar signs, these metacharacters are evaluated by `/bin/sh`, allowing the execution of arbitrary OS commands.

The runner tRPC server contains a missing authentication flaw that allows unauthenticated attackers with network access to the runner port to execute arbitrary JavaScript code. This is achieved by invoking the exposed `start` procedure without credentials, which bypasses the unenforced `RUNNER SECRET KEY` environment variable, leading to remote code execution within the runner process.

Certificate validation failures in SAML authentication allow a malicious agent to forge a SAML response to the management server. To exploit this, an attacker must spoof the IP address of the Identity Provider (IdP) or register a URL of their choice in the management server, enabling unauthorized login using forged signatures.

An authenticated tenant can perform Server-Side Request Forgery (SSRF) by registering a template that points to a malicious metalink file containing internal targets, allowing the Secondary Storage VM to retrieve and persist this data. Additionally, a tenant with the default User role can achieve Remote Code Execution (RCE) as root on the KVM hypervisor host. This occurs when a user registers a VM template with the `directDownload` variable set to true and a URL pointing to a .metalink file; the management server fetches the XML and dispatches the download to the KVM agent without re-validating the inner URLs against the scheme allowlist.

Exposure of sensitive information to an unauthorized actor occurs within the OAuth2 authentication plugin and Google OAuth integration.

A missing integrity verification in the Ruby compatibility shim allows network attackers to execute arbitrary code. By substituting malicious content at formula resource or URL-based patch URLs, attackers can bypass checksum validation. This occurs when downloads for secondary resource and patch paths in `shim.rb` are intercepted or replaced, allowing the injection of attacker-controlled build steps or source tree modifications. These modifications execute during source builds performed via the `zb install --build-from-source` command without triggering an integrity warning.

A stored cross-site scripting issue exists in the HTML export functionality. Attackers can execute arbitrary JavaScript by embedding malicious payloads in dataset titles. This occurs when the `export book()` function in the ` html.py` format handler interpolates these titles unsanitized into the HTML output, rendering them unescaped inside an HTML h3 tag. The attack can be triggered by renaming worksheet sheets in imported files such as XLSX, ODS, XLS, or YAML with script payloads assigned to the `Dataset` title attribute. This can lead to session hijacking, unauthorized administrative actions, and sensitive data exposure when the output is rendered in a browser.

An unauthenticated database-destruction and arbitrary-data-injection issue exists in the Socket.IO server's `database backup` event handler. Due to disabled authentication enforcement and a wildcard CORS (Cross-Origin Resource Sharing) policy, unauthenticated network peers can connect to the server on port 7000. By emitting the `database backup` event with a `full restore` command containing a caller-supplied SQL blob, an attacker can execute raw `exec driver sql` commands. This allows for the deletion of all existing tables and the recreation of the SQLite database using attacker-controlled `CREATE TABLE` and `INSERT INTO` statements. This can result in the permanent loss of satellite records, orbital sources, hardware configurations, and observation schedules, or the injection of fabricated orbital-source URLs and observation entries that redirect the system to malicious servers during the next scheduled synchronization.

An unauthenticated remote code execution issue exists where remote attackers can execute arbitrary shell commands. This occurs when crafted POST requests are sent to the '/api/fs/exec' endpoint, which passes commands directly to the Node.js `spawn()` function without any allowlist, blocklist, or argument validation. In default Docker deployments where `UI PASSWORD` is not configured, the authentication middleware is bypassed, allowing attackers to execute OS commands as the application user and retrieve the full command output, including stdout, stderr, and exit code, from the server response.

An issue exists in the file-serving endpoints '/api/fs/read', '/api/fs/stat', and '/api/fs/raw' that allows unauthenticated remote attackers to read arbitrary files. By providing an absolute path and setting the `allowOutsideWorkspace` query parameter to `true`, attackers can bypass the workspace boundary check within the `resolveReadPathFromContext()` function. This occurs because the `isPathWithinRoot` guard is vacuous, potentially exposing sensitive data such as JWT signing secrets, SSH private keys, API credentials, and environment variables, which could lead to a full authentication bypass via forged session cookies on password-protected deployments.

An authentication bypass allows unauthenticated remote attackers to terminate the server process, resulting in a denial of service for all active AI coding sessions and locking out legitimate users. This occurs because the '/api/system/shutdown' endpoint is registered in `bootstrap-runtime.js` before the authentication middleware in the Express route handler chain, allowing the shutdown handler to be reached regardless of whether `UI PASSWORD` is configured.

An unauthenticated denial-of-service issue exists in the Socket.IO server's `service control` event handler. Due to disabled authentication enforcement and a wildcard CORS (Cross-Origin Resource Sharing) policy, any network peer can connect to the server on port 7000 without credentials. By emitting the `service control` event with a `restart service` command, an attacker can forcibly terminate the ground-station process. This action stops all active satellite-tracking sessions, SDR recording pipelines, demodulators, decoders, and rotator controllers. In Docker deployments, this can be triggered repeatedly to maintain a persistent denial-of-service state.

An unauthenticated blind server-side request forgery (SSRF) exists in the orbital-source configuration path. This allows an unauthenticated Socket.IO client to force the process to issue outbound HTTP requests to arbitrary destinations. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication and a wildcard CORS policy. By submitting a `data submission` event with a `submit-orbital-sources` action, an attacker can persist a URL in the database. Triggering an orbital sync via the `background task:start` event then causes the system to process this URL. The system fails to implement a scheme allowlist, host validation, or rejection of loopback, RFC1918, or link-local addresses (such as cloud instance metadata at 169.254.169.254). The URL is passed directly to `requests.get` within the ` fetch http 3le()` and ` fetch http omm()` functions in `backend/tlesync/source adapters.py`. While the raw response body is not leaked, HTTP status codes and error messages are emitted via the `orbital sync state` Socket.IO event, acting as an oracle for interpreting internal-service and cloud-metadata responses. This effect is durable as the malicious source persists in the database and re-triggers every 24 hours during the scheduled sync cycle.

An SMTP header injection issue exists where unauthenticated attackers can inject arbitrary SMTP headers by including CRLF (Carriage Return Line Feed) sequences in the event payload title field delivered via webhook. By manipulating the unsanitized title field passed to the SMTP DATA command, attackers can add Bcc recipients for content exfiltration, forge the From address to bypass SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) checks, or inject Content-Type and MIME boundary headers to corrupt message bodies for phishing purposes.

An issue exists in the `CanvasService` gRPC handlers where broken object-level authorization allows authenticated users with viewer-level access in one organization to access resources of other organizations. This occurs when arbitrary canvas or queue UUIDs are supplied without organization scoping. This flaw enables attackers to read cross-tenant execution history and event payloads containing sensitive secrets, write queue items and canvas events into victim organizations, delete arbitrary canvases, and disrupt automation workflows across tenant boundaries.

A stored cross-site scripting issue exists in the `@milkdown/preset-commonmark` and `@milkdown/components` packages. Attackers with document write access can execute arbitrary JavaScript in the browser context of users who open the document or click a rendered link. This occurs because the `parseMarkdown` runner stores raw URL values from the remark AST as `href` mark attributes without validating the URL scheme. Additionally, a call to `DOMPurify.sanitize()` in `edit-view.ts` fails to sanitize bare URL strings, treating them as text nodes and allowing `javascript:` payloads to persist in the link-tooltip preview component and read-only mode anchor elements.

A DOM cross-site scripting issue exists in the `@milkdown/plugin-emoji` package. Unauthenticated attackers can execute arbitrary JavaScript in the host application origin by tricking a victim into pasting attacker-controlled content. The `parseDOM.getAttrs` handler stores the raw `innerHTML` of pasted `span` elements containing `data-type="emoji"` without sanitization. Subsequently, the `toMarkdown` runner assigns this unsanitized value directly to a live DOM element's `innerHTML`, which bypasses the DOMPurify sanitization used in the `toDOM` path and triggers payload execution during every markdown serialization cycle.