提交 #855870: louisho5 picobot 0.2.0 Incomplete List of Disallowed Inputs (CWE-184)

# Technical Details
A dangerous-program blacklist bypass vulnerability exists in the `[ExecTool.Execute]` method in `internal/agent/tools/exec.go` of picobot.

The application fails to recursively inspect wrapped command dispatch. The blacklist only checks `argv[0]`, so a blocked payload such as `rm` can be hidden behind `/usr/bin/env bash -lc`. The command array `["/usr/bin/env","bash","-lc","rm /abs/path/to/marker.txt"]` passes validation and reaches `exec.CommandContext`, which launches `env`, dispatches `bash`, and executes the prohibited command.

# Vulnerable Code
File: `internal/agent/tools/exec.go`
Method: `ExecTool.Execute`
Why: The safety policy inspects only the top-level executable and not nested shell-wrapper execution chains, making the blacklist incomplete and bypassable.

# Reproduction
1. Run the supplied harness with a local provider that returns an `exec` tool call containing `["/usr/bin/env","bash","-lc","rm /abs/path/to/marker.txt"]`.
2. Invoke the normal `picobot agent -m` CLI path so the provider tool call is executed.
3. Confirm the marker file is deleted, while the direct control payload `["rm","/abs/path/to/marker.txt"]` is rejected.

# Impact
- Bypasses Picobot’s intended dangerous-program restrictions for the `exec` tool.
- Enables destructive command execution through wrapper-based dispatch under the Picobot process account.

• 来源: ⚠️ https://github.com/louisho5/picobot/issues/43
• 用户: Eric-h (UID 97582)
• 提交: 2026-06-11 11時27分 (1 月前)
• 管理: 2026-07-13 23時12分 (1 month later)
• 状态: 重复
• VulDB条目: 378163 [louisho5 picobot 直到 0.2.0 exec Tool exec.go ExecTool.Execute 权限提升]
• 积分: 0