Turbinia
Monthly
OS command injection in Google Turbinia's forensic worker fleet allows an attacker who can submit processing requests or control evidence path/name values to execute arbitrary commands on the worker nodes. The root cause, confirmed by PR #1631, is multiple workers (grep, photorec, strings) constructing shell command strings via Python format interpolation and invoking them with shell=True, allowing shell metacharacters in evidence paths to break out of the intended command. The fix, released 2026-07-10, replaces all affected workers with list-based subprocess invocation, eliminating shell interpretation.
OS command injection in Google Turbinia's forensic worker fleet allows an attacker who can submit processing requests or control evidence path/name values to execute arbitrary commands on the worker nodes. The root cause, confirmed by PR #1631, is multiple workers (grep, photorec, strings) constructing shell command strings via Python format interpolation and invoking them with shell=True, allowing shell metacharacters in evidence paths to break out of the intended command. The fix, released 2026-07-10, replaces all affected workers with list-based subprocess invocation, eliminating shell interpretation.