Sebastion f0061817ea fix: remove /debug/exec endpoint that allows authenticated RCE via exec() (#2178) ...

The /api/v1/system/debug/exec endpoint passes user-supplied HTTP body
directly to Python exec(), enabling arbitrary code execution for any
authenticated user when debug_mode is enabled. This is a critical
security risk (CWE-94): a single misconfiguration or compromised JWT
grants full server-side code execution.

Remove the endpoint entirely. The /debug/plugin/action endpoint (which
does not use exec()) is left intact as it serves a different, scoped
purpose.

Co-authored-by: Junyan Chin <rockchinq@gmail.com>

2026-05-19 00:53:39 +08:00

1.7 KiB

Raw Blame History

View Raw