dsh-concise

A JSON body posted with a simple content type (no preflight) from any website the user visits, or from any local process, can flip the Concise state for a session or change the persisted global default. The comment claims the API is loopback-only, but the plugin itself never checks the client address, and unlike /open there is no Origin gate here. Impact is limited to style-state tampering (no data read/exec).

The check passes whenever the Origin string merely contains the Host value and passes unconditionally when no Origin header is sent. Combined with openWithDefaultApp() launching the OS default handler for any existing absolute path, the guard protecting the only process-spawning route is weaker than it appears. Exploitation still requires bypassing the browser preflight plus a valid existing path, so practical impact is low.

On Windows the command line is assembled verbatim, so shell metacharacters such as & in the path are interpreted by cmd. validateOpenTarget currently mitigates this (requires a leading '/', forbids spaces, requires an existing file), but the path still originates from model-generated text and can contain & if such a file exists. Requires a user click on the chip, limiting severity.

Any caller that can read the response (same-origin page or local process) learns the working directory, the candidate directory list and every other session's cwd. GET /cwd has no origin check at all, and the debug object leaks cross-session data unrelated to the request. Browser cross-origin reads are blocked only by the absence of CORS headers, which the plugin does not control.