dsh-fleet

POST /dsh-fleet/api/start-local forwards body.startCommand straight into spawn(..., {shell:true}) as the DSH user; the only barrier is guardPost (POST + Origin.host===Host + loopback socket). There is no CSRF token and no Host validation, so a page that resolves to 127.0.0.1 (DNS rebinding) sends a matching Origin/Host pair and from the browser's point of view is same-origin, yielding arbitrary command execution on the developer machine. Same command is also persisted through set-start-command.

local-sessions, local-session-content, local-fresh, local-live, update-check, remote-* and remote-cert are gated only by socket.remoteAddress being loopback. A DNS-rebinding page keeps Origin===Host and connects from 127.0.0.1, so it can read full conversation transcripts (user/assistant text, reasoning, tool args/results up to 200k chars each) that routinely contain secrets, and can trigger outbound probes/cert grabs to arbitrary registered origins. /api/state is even less guarded (method check only) and discloses config paths and remote origins.

The bearer token that protects all session transcripts is put in the query string both when calling remotes and when the gateway validates it, so it leaks into proxy/access logs, browser history and Referer; the gateway defaults to binding 0.0.0.0 with no TLS and no rate limiting, so anyone on the LAN who observes or guesses the token can dump every conversation in $DSH_HOME/sessions.

selfUpdateViaRest downloads package.json, lib/index.js and client/client.js from api.github.com/raw/jsDelivr (or from any URL in DSL_FLEET_UPDATE_URL) and renames them over the live package with no signature or hash check, then relaunches the process. A compromised repo/CDN or mirror gets code execution on every updating host; reachability is limited to the guarded loopback+same-origin POST.

Any remote registered with insecure:true has every probe, session fetch and restart call accepted over MITM-able TLS (rawGet) and cert capture (grabTlsChain) also runs with verification disabled, so an on-path attacker impersonating the remote can serve fabricated transcripts and receive the serveToken in the query string.