Repository navigation
[Security] OS Command Injection in "ip link show" #80
Description
Activity
- added a commit that references this issue
on Aug 13, 2026 Thanks for reporting! I committed migration to
subprocess.run()in d31140b, I will do a bit more testing and release a new version in a day or two.As I do not think this is major issue, I don't think the overhead of getting CVE ID is worth it. If you want to get one feel free to go ahead.
SECURITY.mdadded in 633fede- Hi brona, Thanks for the quick fix and the transparent response! I understand your reasoning regarding the severity. I will hold off for now and request the CVE via GitHub Security Lab once the new patched version is officially released, as you gave permission. Thanks again for maintaining the project. Best regards, Yassin
v1.7.5 released, it will be picked up by homebrew autobump.
Hi, the SECURITY.md template is blank and doesn't specify a private reporting method. If possible, please restrict the visibility of this issue or let me know an email to contact.
There is an OS Command Injection vulnerability in the
ip link showhandler. User input fromargvis concatenated directly into a shell command without sanitization:status, res = subprocess.getstatusoutput(IFCONFIG + " -v " + param + " 2>/dev/null")Because
subprocess.getstatusoutputusesshell=Trueunder the hood, an attacker can break out of the intended command.Proof of Concept:
ip link show "eth0; id"This will execute the
idcommand on the host machine.Suggested Fix:
Sanitize the input using
shlex.quote(param)before concatenation, or switch tosubprocess.run([IFCONFIG, "-v", param], shell=False).CVE Request:
I would like to request a CVE ID for this finding. Are you able to coordinate with a CNA to assign one, or would you prefer if I reach out to a CNA (like GitHub Security Lab) on your behalf to get it assigned?