| शीर्षक | jishi node-sonos-http-api 3776f0e (Mar 22, 2025) OS Command Injection |
|---|
| विवरण | Remote Code Execution via OS Command Injection in Text‑to‑Speech Handler
Code reference: https://github.com/jishi/node-sonos-http-api/blob/3776f0ee2261c924c7b7204de121a38100a08ca7/lib/tts-providers/mac-os.js#L55-L64
Maintainer report: https://github.com/jishi/node-sonos-http-api/issues/915
vulnerability in the macOS TTS provider. In lib/tts-providers/mac-
os.js (current master, commit 3776f0e from 2025‑03‑22), user‑supplied
input from the /say endpoint is interpolated into shell command
strings passed to child_process.exec() without sanitization. An
attacker can inject arbitrary shell commands by crafting malicious
input in the phrase parameter, achieving RCE with the privileges of
55–62, with execution at line 64.
var execCommand = \say "${phrase}" -o ${filepath}`;`
appear in the conditional branches forselectedVoiceandselcetedRate.
Execution occurs via exec(execCommand, ...)`.
GET /bedroom/say/test%22;%20touch%20/tmp/pwned;%20echo%20%22x
This payload closes the quote, injects a command, and neutralizes the
Prerequisites
- Target running macOS
- macSay enabled in settings.json
- HTTP API reachable
Impact
- Full system compromise (Node.js process privileges)
CWE
CWE‑78 (OS Command Injection)
CVSS v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Score: 9.8 (Critical)
Remediation
Replace exec() with execFile() and pass arguments as an array:
const { execFile } = require('child_process');
const args = [];
if (selectedRate && selectedRate !== "default") args.push('-r',
selectedRate);
if (selectedVoice) args.push('-v', selectedVoice);
args.push(phrase, '-o', filepath);
execFile('say', args, callback);
Verification
Static code analysis of public repository (3776f0e, 2025‑03‑22). No
runtime testing required to confirm exploitability. |
|---|
| स्रोत | ⚠️ https://github.com/jishi/node-sonos-http-api/issues/915 |
|---|
| उपयोगकर्ता | XavLimSG (UID 95187) |
|---|
| सबमिशन | 05/02/2026 09:49 AM (8 महीनों पहले) |
|---|
| संयम | 17/02/2026 02:48 PM (12 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 346280 [jishi node-sonos-http-api तक 3776f0ee2261c924c7b7204de121a38100a08ca7 TTS Provider mac-os.js Promise phrase अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|