mosaicstack/stack
1
0
Fork 1
Code Issues 207 Pull Requests 14 Actions Packages Projects Releases 15 Wiki Activity

fix(security): mosaic-init RCE — eval on prompt answers → printf -v (#1115) #1127

Open
mos-dt-0 wants to merge 1 commits from fix/mosaic-init-rce into next
pull from: fix/mosaic-init-rce
merge into: :next
Conversation 0 Commits 1 Files Changed 3
+26 -5
mos-dt-0 commented 2026-08-09 07:34:41 +00:00
Collaborator
Copy Link
Copy Source

SECURITY (#1115): mosaic-init evaled interactive prompt answers (eval "$var_name=\"$value\"" at 4 sites) — a $() or backtick in the FIRST command a new user runs executed arbitrary code / crashed init. Fixed: printf -v "$var_name" %s "$value" at all four sites (0 eval remaining). Red-first regression test test-mosaic-init-rce.sh feeds literal "$(touch /tmp/pwned)" and asserts the answer round-trips LITERALLY and /tmp/pwned is never created. fred §4 gate: code+security PASS, test reproduced green. Structure-independent (does not depend on the ~/.mosaic/W-F rework). Found by scooby greenfield audit.

SECURITY (#1115): mosaic-init evaled interactive prompt answers (eval "$var_name=\\"$value\\"" at 4 sites) — a $() or backtick in the FIRST command a new user runs executed arbitrary code / crashed init. Fixed: printf -v "$var_name" %s "$value" at all four sites (0 eval remaining). Red-first regression test test-mosaic-init-rce.sh feeds literal "$(touch /tmp/pwned)" and asserts the answer round-trips LITERALLY and /tmp/pwned is never created. fred §4 gate: code+security PASS, test reproduced green. Structure-independent (does not depend on the ~/.mosaic/W-F rework). Found by scooby greenfield audit.
mos-dt-0 added 1 commit 2026-08-09 07:34:42 +00:00
fix(mosaic): prevent init prompt code execution
ci/woodpecker/pr/ci Pipeline was successful
Details
12677a928d
All checks were successful
ci/woodpecker/pr/ci Pipeline was successful
Details
You are not authorized to merge this pull request.
This pull request can be merged automatically.
This branch is out-of-date with the base branch
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin fix/mosaic-init-rce:fix/mosaic-init-rce
git checkout fix/mosaic-init-rce
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
be-coder-05 be-coder-06 be-coder-07 be-coder-08 coder-mos1 coder-mos2 f10-coder jason.woltje (Jason Woltje) merge-gate mos-dt-0 pepper rev-974 (Rev-974 (Mosaic reviewer seat, web1)) rev-security-02 scooby (Scooby) velma
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1127