Skip to content

fix: run the binary directly in verify_binary instead of through a shell (CWE-78) - #43

Open
07souravkunda wants to merge 3 commits into
masterfrom
locsec/WI-cf38e835
Open

fix: run the binary directly in verify_binary instead of through a shell (CWE-78)#43
07souravkunda wants to merge 3 commits into
masterfrom
locsec/WI-cf38e835

test: pin the array-form behaviour with a real binary at a hostile path

e766c21
Select commit
Loading
Failed to load commit list.
GitHub Advanced Security / Semgrep OSS succeeded Aug 12, 2026 in 4s

1 new alert

New alerts in code changed by this pull request

  • 1 warning

See annotations below for details.

View all branch alerts.

Annotations

Check warning on line 143 in lib/browserstack/localbinary.rb

See this annotation in the file changed.

Code scanning / Semgrep OSS

Semgrep Finding: ruby.lang.security.dangerous-exec.dangerous-exec Warning

Detected non-static command inside IO.popen. Audit the input to 'IO.popen'. If unverified user data can reach this call site, this is a code injection vulnerability. A malicious actor can inject a malicious script to execute arbitrary code.