-
Notifications
You must be signed in to change notification settings - Fork 30
Open
Labels
priority: highHigh priority issuesHigh priority issuessecuritySecurity vulnerabilitiesSecurity vulnerabilities
Description
Severity: HIGH
Location
ralph/ralph_loop.sh:191
Description
The error message for a missing driver uses xargs without -0, susceptible to filename-based injection. Combined with the RALPH_DIR override, crafted filenames could inject content into the pipeline.
Suggested fix
Replace with a safe glob loop using basename directly.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
priority: highHigh priority issuesHigh priority issuessecuritySecurity vulnerabilitiesSecurity vulnerabilities