Coder Api
Monthly
Command injection in MauricioMilano coder-api (all versions through 1.1.0) allows a local, low-privileged attacker to execute arbitrary OS commands via the createProject function in the Projects Endpoint. The vulnerability stems from unsanitized input passed to a system command in src/core/projects.ts, enabling an attacker with local access to manipulate project creation inputs and achieve code execution in the application's runtime context. A proof-of-concept exploit exists (CVSS 4.0 E:P), no patch has been released, and the project maintainer has not responded to the responsible disclosure report.
Command injection in MauricioMilano coder-api (all versions through 1.1.0) allows a local, low-privileged attacker to execute arbitrary OS commands via the createProject function in the Projects Endpoint. The vulnerability stems from unsanitized input passed to a system command in src/core/projects.ts, enabling an attacker with local access to manipulate project creation inputs and achieve code execution in the application's runtime context. A proof-of-concept exploit exists (CVSS 4.0 E:P), no patch has been released, and the project maintainer has not responded to the responsible disclosure report.