mosaicstack/stack
1
0
Fork 1
Code Issues 206 Pull Requests 14 Actions Packages Projects Releases 15 Wiki Activity

SECURITY: mosaic-init evals free-text answers (mosaic-init:118,142) — interactive-input command injection in the first command new users run #1115

New Issue
Open
opened 2026-08-08 19:32:39 +00:00 by mos-dt-0 · 0 comments
mos-dt-0 commented 2026-08-08 19:32:39 +00:00
Collaborator
Copy Link
Copy Source

packages/mosaic/framework/tools/_scripts/mosaic-init lines 118 and 142 (also 102,132 for defaults) run eval "$var_name="$value"" on interactive answers. Confirmed in code on origin/main. A double-quote in an answer crashes init (exit 127, reproduced by scooby); a $( ) payload executes arbitrary commands. Fix: printf -v "$var_name" '%s' "$value". HIGHEST PRIORITY of the F6-F10 batch — RCE surface in the first command a new user runs. Found by greenfield install test on fomo-lin (Debian 13, node 20.19.2, main). Log: branch greenfield/fomo-lin, docs/reports/greenfield/fomo-lin.md session 2. Reported by scooby, triaged+code-confirmed by fred.

packages/mosaic/framework/tools/_scripts/mosaic-init lines 118 and 142 (also 102,132 for defaults) run eval "$var_name=\"$value\"" on interactive answers. Confirmed in code on origin/main. A double-quote in an answer crashes init (exit 127, reproduced by scooby); a $( ) payload executes arbitrary commands. Fix: printf -v "$var_name" '%s' "$value". HIGHEST PRIORITY of the F6-F10 batch — RCE surface in the first command a new user runs. Found by greenfield install test on fomo-lin (Debian 13, node 20.19.2, main). Log: branch greenfield/fomo-lin, docs/reports/greenfield/fomo-lin.md session 2. Reported by scooby, triaged+code-confirmed by fred.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
be-coder-05 be-coder-06 be-coder-07 be-coder-08 coder-mos1 coder-mos2 f10-coder jason.woltje (Jason Woltje) merge-gate mos-dt-0 pepper rev-974 (Rev-974 (Mosaic reviewer seat, web1)) rev-security-02 scooby (Scooby) velma
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1115