@taxueseek/dsh-models

The /api/model-picker/subagent handler takes sessionId from the query string and provider/model straight from the request body (the only check is the truthiness test `if (!provider || !model)`), then stores them and the `agent/request` waterfall uses them to override every subagent request for that session. There is no origin, method-token or caller check, and a cross-origin page can send the body as text/plain without a preflight; exploitation still requires knowing the target session id (a UUID), and the chosen provider must already be configured on the host, so impact is limited to silently

runDim() passes these candidates to execFile (line 84) with fixed arguments, so there is no shell injection and no user-controlled argv. The pinned ~/.local/bin path is tried first, but if it is missing an executable named `dim` earlier in the host's PATH is spawned on every catalog refresh (~10 min) and its JSON output feeds the price/context/discovery data the picker shows. Preconditions are strong: an attacker must already be able to write an executable into a directory on the host PATH, i.e. already have code execution, so this is a hardening gap rather than a live attack path.