cmd-shim Shebang Injection Leading to Remote Code Execution

[dfzysmy2tf-create]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

When parsing shebang lines from target files, cmd-shim directly concatenates the extracted prog (interpreter path) and args (interpreter arguments) into generated shim scripts (.cmd/.sh/.ps1) without any sanitization, escaping, or validation. This allows attackers to inject arbitrary system commands into shebang lines, which are executed when the generated shim scripts are run.

Expected Behavior

cmd-shim should strictly validate and sanitize all parsed prog and args values before inserting them into shim scripts. Dangerous characters and command injection patterns must be blocked or escaped to prevent arbitrary command execution. Only safe, whitelisted interpreter paths and arguments should be allowed.

Steps To Reproduce

1. Create a malicious npm package with a bin file containing an injected shebang line:

#!/usr/bin/env node
echo PWNED & REM  // Malicious cmd injection payload for Windows
console.log("Legitimate package code");

2. Publish or locally link the malicious package, then install it in a test environment:

npm install ./malicious-pkg

3. Observe the generated shim scripts (e.g., .cmd on Windows) contain the injected command:

endLocal & goto #_undefined_# 2>NUL || title %COMSPEC% & "%_prog%" 
echo PWNED & REM "%dp0%\malicious-pkg" %*

4. Execute the package's bin command:

npx malicious-pkg

5. The injected command echo PWNED is executed, demonstrating arbitrary command execution.

Environment

• npm:7.6.3
• Node:13.14.0
• OS:Ubuntu 20.04
• platform:MacBook Pro