🟠 [HIGH] CB-009: os.execv Restart Allows Argument Injection #18

New issue

Open

opened 2026-02-20 08:50:04 +00:00 by Alpha · 0 comments

Alpha commented

2026-02-20 08:50:04 +00:00

Security Finding from Audit

Parent issue: #1

Severity

HIGH 🟠

CVSS Score

N/A

CWE

CWE-88 (Improper Neutralization of Argument Delimiters)

Location

agent.py line 73, cli.py line 172

Description

The restart mechanism uses os.execv(sys.executable, [sys.executable] + sys.argv) to replace the current process. If sys.argv has been manipulated (e.g., through the restart_self tool or by writing to /proc/self/cmdline), the restart can execute arbitrary commands.

Recommendation

Use a fixed, validated restart command rather than replaying sys.argv. Consider using systemd restart exclusively.

From: Cobot Whitebox Security Audit (February 14, 2026)
Finding ID: CB-009

## Security Finding from Audit > Parent issue: #1 ### Severity **HIGH** 🟠 ### CVSS Score N/A ### CWE CWE-88 (Improper Neutralization of Argument Delimiters) ### Location `agent.py line 73, cli.py line 172` --- ### Description The restart mechanism uses `os.execv(sys.executable, [sys.executable] + sys.argv)` to replace the current process. If `sys.argv` has been manipulated (e.g., through the `restart_self` tool or by writing to `/proc/self/cmdline`), the restart can execute arbitrary commands. --- ### Recommendation Use a fixed, validated restart command rather than replaying `sys.argv`. Consider using systemd restart exclusively. --- *From: Cobot Whitebox Security Audit (February 14, 2026)* *Finding ID: CB-009*