dmgerman / ninka

a license identification tool for Source Code
http://ninka.turingmachine.org
GNU General Public License v2.0
105 stars 31 forks source link

Remote code execution in bin/ninka-excel and bin/ninka-sqlite #42

Open rillig opened 6 years ago

rillig commented 6 years ago

These programs use backticks command execution, which interprets shell commands. This means that a filename containing a single quote can be used to execute arbitrary code on the system analyzing a package.

Publicly reported since neither of these files is installed by default.