@cny919191/dsh-123pan

The /upload and /uploadBatch (/uploadBatch at line 387, `for (const file of files) { ... coreUpload(config(), { file, parentId })`) handlers accept any path readable by the DSH process and push it to the user's 123pan account. Any local process can POST to the loopback bridge, and the unaudited AI tool layer (index.js/lib/tools.js) most likely wraps these same handlers, so a prompt-injected model can exfiltrate ~/.ssh, .env, backups.json or other sensitive files to a remote service. No path allowlist, no workspace confinement, no confirmation beyond the caller's own intent.

The `out`/`dir` values come straight from the request body: the handler creates missing directories and writes anywhere the DSH process can write (not confined to the workspace or config downloadDir), and `name` (a remote listing entry passed by client.js) is joined without traversal checks. Reachable only via loopback POST with a matching Origin, so the attacker must already run code as the user; the risk is overwriting unintended files or escaping the chosen download directory via a hostile remote file name.

saveSession serializes the session JSON (including `token`) and dpapiProtect passes it in argv to 123pan-core.exe, so the plaintext token is visible in the process command line for the duration of the call — contradicting the module's own policy of keeping credentials out of argv (coreLogin deliberately uses DSH_123PAN_PASSWORD via env). Same-user processes and administrators can read it.