dsh-better-uiux

GET /api/better-uiux/output returns the full stdout, command line, cwd and session id of any foreground process or background job, with no auth, no Origin check and `Access-Control-Allow-Origin: *`. Because the GUI is served from the same origin, the wildcard header is unnecessary; it lets any website the user visits read these responses from 127.0.0.1 (port scanning is enough) — and the 'only one active process' fallback means no id is even needed. Terminal output routinely contains tokens, env dumps and file contents, so this is a cross-origin secret-exfiltration channel. The same handler is

The stop handler never inspects `req.method`, has no CSRF/Origin check and advertises `Access-Control-Allow-Origin: *`, so a plain `<img src="http://127.0.0.1:PORT/api/better-uiux/stop?mode=wait|&jobId=...">` on any website cancels background jobs, SIGTERMs foreground processes and on Windows runs `taskkill /F /T` on their pid tree. Combined with the readable /jobs endpoint the attacker can enumerate ids and commands first, turning this into a remote denial-of-service against whatever the agent is running.

POST /api/better-uiux/config accepts a CSS string from any origin (wildcard CORS plus `Access-Control-Allow-Headers: Content-Type` allows the JSON preflight) and persists it to config.json; core.js then injects it into `<head>` via `tag.textContent = css` on every load. A malicious page can therefore permanently restyle or overlay the Harness UI (fake credential/dialog panels, hidden or spoofed controls) for all future windows, and use CSS selector + url() tricks to probe DOM state. No Origin or CSRF check exists on this write path.