| Título | jishi node-sonos-http-api 3776f0e (Mar 22, 2025) OS Command Injection |
|---|
| Descrição | Remote Code Execution via OS Command Injection in Text‑to‑Speech Handler
Code reference: https://github.com/jishi/node-sonos-http-api/blob/3776f0ee2261c924c7b7204de121a38100a08ca7/lib/tts-providers/mac-os.js#L55-L64
Maintainer report: https://github.com/jishi/node-sonos-http-api/issues/915
vulnerability in the macOS TTS provider. In lib/tts-providers/mac-
os.js (current master, commit 3776f0e from 2025‑03‑22), user‑supplied
input from the /say endpoint is interpolated into shell command
strings passed to child_process.exec() without sanitization. An
attacker can inject arbitrary shell commands by crafting malicious
input in the phrase parameter, achieving RCE with the privileges of
55–62, with execution at line 64.
var execCommand = \say "${phrase}" -o ${filepath}`;`
appear in the conditional branches forselectedVoiceandselcetedRate.
Execution occurs via exec(execCommand, ...)`.
GET /bedroom/say/test%22;%20touch%20/tmp/pwned;%20echo%20%22x
This payload closes the quote, injects a command, and neutralizes the
Prerequisites
- Target running macOS
- macSay enabled in settings.json
- HTTP API reachable
Impact
- Full system compromise (Node.js process privileges)
CWE
CWE‑78 (OS Command Injection)
CVSS v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Score: 9.8 (Critical)
Remediation
Replace exec() with execFile() and pass arguments as an array:
const { execFile } = require('child_process');
const args = [];
if (selectedRate && selectedRate !== "default") args.push('-r',
selectedRate);
if (selectedVoice) args.push('-v', selectedVoice);
args.push(phrase, '-o', filepath);
execFile('say', args, callback);
Verification
Static code analysis of public repository (3776f0e, 2025‑03‑22). No
runtime testing required to confirm exploitability. |
|---|
| Fonte | ⚠️ https://github.com/jishi/node-sonos-http-api/issues/915 |
|---|
| Utilizador | XavLimSG (UID 95187) |
|---|
| Submissão | 05/02/2026 09h49 (há 3 meses) |
|---|
| Moderação | 17/02/2026 14h48 (12 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 346280 [jishi node-sonos-http-api até 3776f0ee2261c924c7b7204de121a38100a08ca7 TTS Provider mac-os.js Promise phrase Elevação de Privilégios] |
|---|
| Pontos | 20 |
|---|