Pheditor: Terminal command-allowlist bypass via argument injection leads to RCE — surviving vector after the metacharacter-sanitization fixes
Affects pheditor/pheditorSource GCVE Database
- Patch
- Available – fixed in 2.0.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HWhat to do
AI-suggested
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Recommended mitigations include validating the full command and its arguments rather than just the prefix, rejecting dangerous flags for allowlisted binaries, running commands as argv arrays through a restricted launcher without a shell, or removing binaries capable of code execution from the allowlist. Until an official fix is available, avoid enabling the terminal feature or restrict terminal permissions to trusted users only.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Packagistpheditor/pheditor | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
Pheditor's terminal feature enforces an allowlist of commands by prefix matching but does not validate command arguments. This allows attackers with terminal permission to execute arbitrary commands by abusing allowlisted binaries that accept options enabling code execution. The vulnerability bypasses prior metacharacter sanitization fixes and leads to remote code execution under the web server's privileges. The default configuration includes a hardcoded admin password, amplifying the risk by enabling unauthenticated RCE. The issue affects versions prior to 2.0.7.
Weaknesses
References
- github.com/pheditor/pheditor/security/advisories/GHSA-g3hq-hphg-8fhh (opens in a new tab)
- github.com/pheditor/pheditor/commit/f40f5070d5a171b65359bc87568734d31de498e1 (opens in a new tab)
- github.com/pheditor/pheditor (opens in a new tab)
- github.com/pheditor/pheditor/releases/tag/2.0.7 (opens in a new tab)