Smaranchand

A flaw in the permission splitter logic fails to conservatively split or reject certain Bash shell constructs that create command-execution boundaries or nested execution. This improper input validation and parsing of shell syntax allows a permitted prefix, such as 'git', to mask an additional command. Consequently, the `rtk rewrite` function returns exit code 0, leading the Claude hook to emit a permissionDecision of "allow". This enables the hidden command to execute without the user confirmation or denial intended by the permission rules, potentially leading to unauthorized command execution under the user's context.

PMD, a static code analyzer, contains a flaw where its `vbhtml` and `yahtml` report formats do not properly escape characters when inserting rule violation messages into HTML output. Analyzing untrusted source code with crafted string literals can lead to the generation of HTML reports containing executable JavaScript code that runs when the report is opened in a web browser. The default `html` format is not affected. The practical impact is limited as `vbhtml` and `yahtml` are legacy formats rarely used.

MobSF is a mobile application security testing tool. A Stored Cross-site Scripting (XSS) vulnerability exists in MobSF’s Android manifest analysis. This allows an attacker to execute arbitrary JavaScript in a victim’s browser session by uploading a malicious APK. Specifically, the `android:host` attribute from `<data android:scheme="android secret code">` elements is rendered in HTML reports without proper sanitization, potentially leading to session hijacking and account takeover. The vulnerability is triggered when MobSF analyzes an Android APK containing a `<data>` element with `android:scheme="android secret code"`, extracting the `android:host` attribute and inserting it directly into the analysis report without HTML escaping. The vulnerable code path involves data extraction from the manifest file, template string formatting, and unsafe rendering of the extracted data in the HTML report. A proof-of-concept (PoC) APK has been created to demonstrate the vulnerability.