Useworld

The `grep()` function exported by @augment-vir/node inserts caller-controlled search patterns into a double-quoted shell command string without sanitization. When this command is passed to the `spawn()` function with the shell set to 'bash', the shell evaluates command substitution expressions embedded in the pattern. This allows for arbitrary OS command execution with the privileges of the Node.js process user. Applications passing untrusted input to the `pattern` or `patterns` fields of the `grep()` function are susceptible to unauthenticated local or remote code execution.

The unauthenticated '/api/modelTraining' endpoint calls the `trainModel()` function in GrobidRestProcessTraining.java. Each request creates a new fixed thread pool via `Executors.newFixedThreadPool(1)`, submits a training task, and leaves the executor running. Repeated requests cause the permanent retention of JVM worker threads, which can exhaust the thread capacity of the process or operating system, leading to degraded performance or a complete stop in request processing.

The `buildWSLegacyExecutor()` function in the executor-legacy-ws module hardcodes the TLS certificate rejection to off for Node.js connections to wss:// endpoints. This allows applications using the executor directly, or the url-loader with `SubscriptionProtocol.LEGACY WS`, to accept certificates controlled by an attacker during a network interception. This can lead to the disclosure of authentication material within `connectionParams` or headers, and the modification of subscription data. Browser WebSocket clients are not affected as they enforce certificate validation.

In the default configuration, the getter that populates request decorations reads the client-controlled `x-apigateway-event` and `x-apigateway-context` HTTP headers before falling back to the trusted internal request token. Because these reserved headers are not stripped from the incoming event, an unauthenticated attacker can set these headers to forge the entire Lambda proxy event, including the authorizer context. This allows the attacker to override genuine data, leading to a full authentication and authorization bypass and privilege escalation for applications that rely on `request.awsLambda.event` or `request.awsLambda.context` for identity or access control.

An improper cryptographic signature verification issue exists in the APSAdapter component. The default local verifier incorrectly accepts any non-empty string as a valid signature. This allows unauthenticated attackers to submit forged APS delegation payloads with arbitrary scopes, bypassing signature verification to obtain signed permission-grant tokens for sensitive resources, such as `SHELL EXEC`.

Pi loads project-local configuration and resources from a repository's `.pi` directory without requiring user trust. This includes project-local extensions, which are executable TypeScript or JavaScript modules loaded directly into the Pi process. An attacker controlling a repository can place malicious Pi-specific resources within it; if a user starts Pi from that working tree, the extension code executes with the same privileges as the local Pi process. The affected component is the project resource loading path, which previously initialized `.pi/settings.json`, project package-managed resources, and project instruction files during session initialization before a trust boundary was established. Because extensions are not sandboxed, they can register commands, tools, and event handlers, allowing access to files, environment variables, credentials, the network, and local tools available to the user.

The `get diagnostics` MCP tool loads and executes all DiagnosticAnalyzer assemblies referenced by the target solution without an allowlist, signature check, or user confirmation. Because the `includeAnalyzers` variable defaults to true, no explicit opt-in is required. An attacker can achieve arbitrary code execution in the server process with the server's OS privileges by placing a malicious `.csproj` file that references an attacker-controlled DLL in a location opened by the victim using the MCP server.