Skip to content

Fix command injection in volume and LNK parsing#10

Merged
khyrenz merged 1 commit intokhyrenz:mainfrom
mobasi-team:mobasi/security-fixes
Feb 8, 2026
Merged

Fix command injection in volume and LNK parsing#10
khyrenz merged 1 commit intokhyrenz:mainfrom
mobasi-team:mobasi/security-fixes

Conversation

@mobasi-team
Copy link

Summary

  • remove shell usage when listing volume contents (no command injection via -v)
  • remove shell usage for LNK parsing by calling lnkparse without a shell and handling missing binary

Testing

  • parseusbs/poc/vuln-001_poc.py
  • parseusbs/poc/vuln-002_e2e.py

@khyrenz khyrenz merged commit 5689807 into khyrenz:main Feb 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants