fix(security): input validation for 4 command injection vectors (issue #6089)#6112
Open
nexadodigital wants to merge 1 commit into
Open
fix(security): input validation for 4 command injection vectors (issue #6089)#6112nexadodigital wants to merge 1 commit into
nexadodigital wants to merge 1 commit into
Conversation
…nitech#6089) Four unpatched command injection vulnerabilities from issue Unitech#6089: - Startup.js: validate service_name before passing to systemctl shell commands (prevents RCE as root via --service-name flag) - LogManagement.js: validate user param before writeFileSync path construction (prevents path traversal and logrotate postrotate script injection) - Extra.js: add explicit allowlist for remoteV2 command parameter (prevents arbitrary CLI method invocation via RPC) - Deploy.js: validate env name before shell string construction (prevents shell injection in post-deploy commands) Ref: Unitech#6089
|
Parv Sharma seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account. You have signed the CLA already but the status is still pending? Let us recheck it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security Fix: Command Injection and Arbitrary Method Invocation
Fixes 4 unpatched vectors from issue #6089 (reported 2026-03-06).
Vulnerability Summary
service_nameinjectionlib/API/Startup.jssystemctluserpath traversallib/API/LogManagement.jsremoteV2method injectionlib/API/Extra.jspost-deployshell injectionlib/API/Deploy.jsFix Approach
All fixes follow the same minimal pattern — validate attacker-controlled string inputs against a strict allowlist regex before they reach shell execution or filesystem operations. No dependencies added, no behavior changed for valid inputs.
Vectors already patched (not in this PR)
Ref: #6089