dsh-git

The 'onto' value is inserted directly into the git argument vector after --autostash with no '--' separator, so 'onto=--exec=<cmd>' is parsed by git as an option and runs an arbitrary command after each commit. Separately, todo.hash is only checked to be a string and is written verbatim into the rebase todo file, so a hash containing a newline injects a 'exec <cmd>' line. Once a repo is open and the endpoint is reachable (loopback server with no auth, or a page via DNS rebinding), this yields arbitrary command execution as the user.

The server accepts requests from any local process and, because it sets no authentication, no Host-header check, and no CORS policy, is reachable from a malicious web page via DNS rebinding. Such a caller can drive destructive endpoints (reset --hard, discard, checkout -f), read recent local repo paths and the SSH public key, and combine with the injection above. Loopback binding and arg-vector execFile calls mitigate but do not remove the risk.

Unlike the discard handler which calls resolveRepoFile(), the untracked-file branch of /api/diff resolves the path with plain path.join and then fs.readFileSync. If a path (or an in-repo symlink reported as untracked) points outside the repo, file contents are read and returned. Exploitation is gated by git reporting the path as '??', so reachable impact is limited, but the containment asymmetry is a real hardening gap.