Threats tagged 'ghsa-xj9x-9j3p-fff9'

OpenChamber 1.11.7 has a critical unauthenticated remote code execution vulnerability via the /api/fs/exec endpoint. Attackers can send crafted POST requests that execute arbitrary shell commands because the application passes commands directly to Node.js spawn() without validation. The default Docker deployment disables authentication, allowing remote attackers to run OS commands as the application user and receive full command output.