dsh-better-display

data.path is taken verbatim from the POST body with no normalization, allow-list (e.g. must stay under the workspace) or existence check, and the route performs no auth/origin check of its own. On Linux, xdg-open on an attacker-chosen path can launch an arbitrary application or .desktop file and open arbitrary URLs; on macOS 'open -R' reveals/opens whatever path is given. A malicious page the user visits can issue a no-cors POST with a text/plain body that still parses as JSON, so CSRF to the local server is enough to drive the primitive without user interaction beyond loading the page. Precon

The path is concatenated into a single explorer.exe argument, and explorer.exe re-parses that argument itself. A UNC value such as \\attacker\share\x makes Windows attempt SMB authentication to a remote host, leaking the user's NTLM hash; commas or additional /select-like fragments also change explorer's own argument parsing, and the plugin never rejects remote/UNC or comma-containing paths.

The handler buffers the whole body in memory with no length cap and no content-type/encoding check, so a single oversized POST (possibly cross-origin via no-cors) can grow process memory, and multi-byte UTF-8 split across chunk boundaries can corrupt the JSON and produce confusing 400s. DoS impact is limited because the server is normally localhost-bound.