dsh-local-models

Because r === FILESYSTEM_ROOT short-circuits, isPathAllowed() returns true for every absolute path, so the checks in /local-models/browse, /local-models/gguf-meta, /local-models/run and normalizeProfileConfig never reject anything: the documented error 'this tab may not read that path' is unreachable. Any caller of the dsh webserver route can enumerate arbitrary directories (dir=/&all=1) and feed arbitrary files to the GGUF parser (whose error message echoes the first 4 bytes of the file), i.e. host filesystem metadata disclosure and unconfined model-path input. The plugin adds no authenticati

A saved profile whose modelPath (or, for an externally edited profiles.json, whose id) contains a newline injects extra lines/sections into $DSH_HOME/local-models/router-presets.ini, which is then handed to llama-server via --models-preset. This corrupts the router configuration (e.g. injecting keys such as a different bind address) for POST /local-models/router/start. Precondition is real but narrow: the injected path must name an existing file and the store is normally written by this plugin.

POST /local-models/stop with no tracked child first probes the port and then kills (SIGTERM) every pid returned by lsof on that port, excluding only the plugin's own pid. On the default port 8080 that can terminate an unrelated local service. There is no command injection here: PORT is parsed and clamped to 1..65535 at import and the rest of the command string is constant.