test: multi-pass pipeline with linter-rule-judge #57
grichaAnnotations
3 errors
|
Arbitrary Code Execution via eval():
src/config/loader.ts#L133
The evaluateConfigExpression function uses eval() which allows arbitrary JavaScript code execution. If expr comes from user input, attackers can execute any code.
|
|
Arbitrary Code Execution via Function Constructor:
src/config/loader.ts#L137
The createDynamicHandler function uses new Function() which allows arbitrary code execution. If code parameter contains user input, attackers can execute any code.
|
|
Command Injection via Template Literal:
src/config/loader.ts#L123
The runConfigScript function uses execSync with template literal interpolation. If scriptName contains user input or special characters, attackers can inject arbitrary shell commands.
|