| शीर्षक | Yued Fe Lulu UI 3 OS Command Injection |
|---|
| विवरण | A Remote Code Execution vulnerability (CWE-78) exists in the LuLu UI build and documentation synchronization script. The script invokes OS-level commands using child_process.exec() with dynamically constructed command strings. Because exec() spawns a shell and does not enforce argument separation, attackers who can influence the execution environment, Git repository state, or filesystem paths can inject and execute arbitrary OS commands.
The vulnerability is particularly dangerous in shared development environments, CI/CD runners, or systems where the repository or filesystem may be modified by untrusted users or automated processes. |
|---|
| स्रोत | ⚠️ https://github.com/lakshayyverma/CVE-Discovery/blob/main/lulu.md |
|---|
| उपयोगकर्ता | lakshay12311 (UID 91298) |
|---|
| सबमिशन | 31/01/2026 12:04 PM (8 महीनों पहले) |
|---|
| संयम | 15/02/2026 04:54 PM (15 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 346153 [yued-fe LuLu UI तक 3.0.0 run.js child_process.exec अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|