🟡 [MEDIUM] CB-010: Trivially Bypassable Exec Blocklist #19

New issue

Open

opened 2026-02-20 08:50:04 +00:00 by Alpha · 0 comments

Alpha commented

2026-02-20 08:50:04 +00:00

Security Finding from Audit

Parent issue: #1

Severity

MEDIUM 🟡

CVSS Score

N/A

CWE

CWE-184 (Incomplete List of Disallowed Inputs)

Location

tools/plugin.py, _is_exec_allowed()

Description

The regex-based blocklist is fundamentally flawed as a security control.

Example bypasses for a blocklist entry "sudo":

su\do
/usr/bin/sudo
doas
pkexec
echo c3VkbwA= | base64 -d | sh
python3 -c "import os; os.system('sudo ...')"

Recommendation

Replace with strict allowlist. Only permit explicitly approved command patterns.

From: Cobot Whitebox Security Audit (February 14, 2026)
Finding ID: CB-010

## Security Finding from Audit > Parent issue: #1 ### Severity **MEDIUM** 🟡 ### CVSS Score N/A ### CWE CWE-184 (Incomplete List of Disallowed Inputs) ### Location `tools/plugin.py, _is_exec_allowed()` --- ### Description The regex-based blocklist is fundamentally flawed as a security control. **Example bypasses for a blocklist entry "sudo":** - `su\do` - `/usr/bin/sudo` - `doas` - `pkexec` - `echo c3VkbwA= | base64 -d | sh` - `python3 -c "import os; os.system('sudo ...')"` --- ### Recommendation Replace with strict allowlist. Only permit explicitly approved command patterns. --- *From: Cobot Whitebox Security Audit (February 14, 2026)* *Finding ID: CB-010*