🟠 [HIGH] CB-008: Environment Variable Leakage via Subprocess #17

New issue

Open

opened 2026-02-20 08:50:03 +00:00 by Alpha · 0 comments

Alpha commented

2026-02-20 08:50:03 +00:00

Security Finding from Audit

Parent issue: #1

Severity

HIGH 🟠

CVSS Score

N/A

CWE

CWE-214 (Invocation of Process Using Visible Sensitive Information)

Location

tools/plugin.py (env=os.environ.copy()) and security/plugin.py

Description

Both the exec tool and the security plugin pass the full environment to subprocesses. This exposes PPQ_API_KEY, NOSTR_NSEC, TELEGRAM_BOT_TOKEN, and any other secrets stored in environment variables.

The security plugin explicitly injects PPQ_API_KEY into its subprocess environment.

Recommendation

Construct minimal environments for subprocesses containing only required variables (PATH, HOME, LANG).

From: Cobot Whitebox Security Audit (February 14, 2026)
Finding ID: CB-008

## Security Finding from Audit > Parent issue: #1 ### Severity **HIGH** 🟠 ### CVSS Score N/A ### CWE CWE-214 (Invocation of Process Using Visible Sensitive Information) ### Location `tools/plugin.py (env=os.environ.copy()) and security/plugin.py` --- ### Description Both the exec tool and the security plugin pass the full environment to subprocesses. This exposes `PPQ_API_KEY`, `NOSTR_NSEC`, `TELEGRAM_BOT_TOKEN`, and any other secrets stored in environment variables. The security plugin explicitly injects `PPQ_API_KEY` into its subprocess environment. --- ### Recommendation Construct minimal environments for subprocesses containing only required variables (`PATH`, `HOME`, `LANG`). --- *From: Cobot Whitebox Security Audit (February 14, 2026)* *Finding ID: CB-008*