| शीर्षक | handrew browserpilot 0.0 Code Injection |
|---|
| विवरण | browserpilot is an intelligent web browsing agent controlled by natural language with LLM.. The `__run_compiled_instructions` function in the `GPTSeleniumAgent` class of the BrowserPilot project is affected by a code injection vulnerability (CWE - 94). This function utilizes the `exec()` method to run the `instructions` parameter sourced from the `InstructionCompiler`. However, there is no proper verification of these instructions. Attackers can manipulate the input fed into the `InstructionCompiler`, causing malicious Python code to be injected into the `instructions` variable. When `exec()` is executed, this malicious code will run within the program's context. This can lead to severe security issues like unauthorized access to system resources, data leakage, and system compromise. All versions of the project are impacted.
More details: https://github.com/handrew/browserpilot/issues/20 |
|---|
| स्रोत | ⚠️ https://github.com/handrew/browserpilot/issues/20 |
|---|
| उपयोगकर्ता | ybdesire (UID 83239) |
|---|
| सबमिशन | 19/04/2025 02:09 PM (1 वर्ष पहले) |
|---|
| संयम | 02/05/2025 02:55 PM (13 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 307195 [handrew browserpilot तक 0.2.51 gpt_selenium_agent.py GPTSeleniumAgent instructions अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|