dsh-np-ppt

handleExport builds a shell string from JSON supplied to the unauthenticated POST /api/export. deckTitle is only stripped of <>:"/\|?*, so `$`, backticks and `(`/`)` survive; a title such as `$(id)` or `` `id` `` becomes command substitution inside the double-quoted --output argument and is executed by /bin/sh. The sibling helper runExportPptx interpolates outputPath verbatim (`--output "${outputPath}"`) and inserts `--transition ${transition}` unquoted. The endpoint is on 127.0.0.1:55173, but it accepts cross-origin simple POSTs (no Origin/auth/Content-Type check), so a web page visited by th

page.path is taken from the request body and passed to path.resolve without any containment check: an absolute value ('/home/user/.ssh/authorized_keys') or a traversal value ('../../..') resolves outside the mkdtemp directory. dirname()+mkdirSync then create the parent directories and writeFileSync writes fully attacker-controlled content with the privileges of the DSH process, turning the loopback endpoint into an arbitrary file overwrite primitive.

The guard only checks new URL(request.url, 'http://localhost').pathname, but the fetch target is built from the raw request.url with a different base. An absolute-form request target (e.g. 'GET http://169.254.169.254/neo-ppt/ HTTP/1.1', legal in HTTP/1.1) yields pathname '/neo-ppt/' while new URL() ignores the www.kimi.com base, so the server performs an arbitrary GET and relays the response body. Any HTTP client that can reach 127.0.0.1:55173 can use the server to probe/read internal services, bypassing the intended kimi.com-only restriction.

The editor iframe is filled with HTML fetched from https://www.kimi.com by the local proxy, so third-party code executes on the http://127.0.0.1:55173 origin, same-origin with window.neoDeck and with the penpal RPC. That RPC exposes getImages, which (via resolveIndexedPath/resolveImage) returns ANY indexed file of the user-authorized project folder as a data: URL - no image-extension check - and onSave, which writes .pptd/.page files into that folder. Additionally the penpal protocol runtime is dynamically imported from statics.moonshot.cn without integrity pinning, so a compromise of that hos

apply() runs ensurePresetInstalled() unconditionally (no consent, no version check) and overwrites preset.yml / agent.cordis.yml under the user's home with files shipped in the package, executed inside try{}catch{} so failures are invisible. It modifies agent configuration outside the plugin directory at startup; the bundled preset contents are not part of the audited surface.