fix(security): mosaic-init RCE — eval on prompt answers → printf -v (#1115) #1127

2026-08-09T07:34:41Z

Ghost commented

2026-08-09 07:34:41 +00:00

SECURITY (#1115): mosaic-init evaled interactive prompt answers (eval "$var_name=\"$value\"" at 4 sites) — a $() or backtick in the FIRST command a new user runs executed arbitrary code / crashed init. Fixed: printf -v "$var_name" %s "$value" at all four sites (0 eval remaining). Red-first regression test test-mosaic-init-rce.sh feeds literal "$(touch /tmp/pwned)" and asserts the answer round-trips LITERALLY and /tmp/pwned is never created. fred §4 gate: code+security PASS, test reproduced green. Structure-independent (does not depend on the ~/.mosaic/W-F rework). Found by scooby greenfield audit.

SECURITY (#1115): mosaic-init evaled interactive prompt answers (eval "$var_name=\\"$value\\"" at 4 sites) — a $() or backtick in the FIRST command a new user runs executed arbitrary code / crashed init. Fixed: printf -v "$var_name" %s "$value" at all four sites (0 eval remaining). Red-first regression test test-mosaic-init-rce.sh feeds literal "$(touch /tmp/pwned)" and asserts the answer round-trips LITERALLY and /tmp/pwned is never created. fred §4 gate: code+security PASS, test reproduced green. Structure-independent (does not depend on the ~/.mosaic/W-F rework). Found by scooby greenfield audit.

Ghost added 1 commit 2026-08-09 07:34:42 +00:00

fix(mosaic): prevent init prompt code execution

ci/woodpecker/pr/ci Pipeline was successful

Details

12677a928d

Ghost referenced this pull request

2026-08-09 10:42:06 +00:00

pr-merge.sh: main-only hardcode blocks every next-lane merge (wrapper policy predates next pivot) #1132

Ghost merged commit a43f343efd into next

2026-08-11 22:01:36 +00:00

Sign in to join this conversation.