5
npm search RCE? - Escape Sequence Injection (blog.solidsnail.com)
submitted 11 months ago by solidsnail@infosec.pub to c/cybersecurity@infosec.pub
2 comments fedilink hide all child comments
top 2 comments
sorted by: hot top controversial new old
[-] tedu@azorius.net 3 points 11 months ago

This has been a problem for so long, and everyone just kind of assumes that maybe somebody else fixed it at some other layer. Nobody really thinks about it much. Usually because the poc requires certain preconditions, but they're not that hard to find.

[-] solidsnail@infosec.pub 1 points 11 months ago

That is very true.
I do think that there's more depth to it than that. For example, dealing with it on the end of the terminal will probably break compatibility, and dealing with it on the app end will require every single dev to start sanitizing this. The challenges are real.

this post was submitted on 15 Dec 2023
5 points (85.7% liked)

cybersecurity

3306 readers
174 users here now

An umbrella community for all things cybersecurity / infosec. News, research, questions, are all welcome!

Community Rules

Enjoy!

founded 1 year ago
MODERATORS
shellsharks@infosec.pub
tweedge@infosec.pub