Repository navigation
[Security] OS Command Injection in "ip link show" #80
Description
Hi, the SECURITY.md template is blank and doesn't specify a private reporting method. If possible, please restrict the visibility of this issue or let me know an email to contact.
There is an OS Command Injection vulnerability in the ip link show handler. User input from argv is concatenated directly into a shell command without sanitization:
status, res = subprocess.getstatusoutput(IFCONFIG + " -v " + param + " 2>/dev/null")
Because subprocess.getstatusoutput uses shell=True under the hood, an attacker can break out of the intended command.
Proof of Concept:
ip link show "eth0; id"
This will execute the id command on the host machine.
Suggested Fix:
Sanitize the input using shlex.quote(param) before concatenation, or switch to subprocess.run([IFCONFIG, "-v", param], shell=False).
CVE Request:
I would like to request a CVE ID for this finding. Are you able to coordinate with a CNA to assign one, or would you prefer if I reach out to a CNA (like GitHub Security Lab) on your behalf to get it assigned?
Activity
Migrate to subprocess.run() to address #80
brona commentedon Aug 13, 2026
Thanks for reporting! I committed migration to
subprocess.run()in d31140b, I will do a bit more testing and release a new version in a day or two.As I do not think this is major issue, I don't think the overhead of getting CVE ID is worth it. If you want to get one feel free to go ahead.
SECURITY.mdadded in 633fedeV4lar commentedon Aug 13, 2026
brona commentedon Aug 14, 2026
v1.7.5 released, it will be picked up by homebrew autobump.
brona commentedon Aug 14, 2026
Homebrew/homebrew-core#298804 merged