@wonaren/dsh-upgrade

POST /api/dsh-upgrade/start takes `parsed.version` straight from the request body; the only transformation is `targetVersion.trim().replace(/^v/, '')` (line 616), with no semver allow-list or comparison against the registry. That value becomes npm's package spec, and npm accepts far more than plain versions: git URLs, tarball URLs and `npm:<alias>` specs are valid dependency specs, so a caller can make the host install attacker-chosen code globally (`npm install -g @deepseek-ai/dsh@npm:evil-pkg` or a remote tarball). The plugin then calls recordUpgradeNotes and triggerRestartService, so the in

The whole /api/dsh-upgrade prefix is served with wildcard CORS and preflight approval for POST plus Content-Type, and no token, session check, Origin/Host check or CSRF defence anywhere in the handler. Any web page the user browses can therefore issue cross-origin fetch() calls that (a) start an upgrade with an arbitrary version (see critical finding), (b) POST /reset to wipe task state, (c) POST /restart, and can read GET /info, /status and /compatibility responses, which disclose pid, uptime, node version, installed npm path and the local plugin inventory. The wildcard CORS header removes th

POST /api/dsh-upgrade/restart (and the same handler mounted at /api/dsh-restart) is reachable without any credential and immediately schedules `launchctl kickstart -k` on the DSH agent; on failure the fallback path calls process.exit(0) (line 234). Because the endpoint is CORS-open, any visited web page can repeatedly restart the service, aborting in-flight sessions and tool runs (the client itself warns that 'current running inference or tasks will be interrupted'). This is an unauthenticated availability/DoS vector against the developer's tooling, distinct from the upgrade code-execution pat

recordUpgradeNotes writes (and reads) a file outside the plugin's own scope under the author's personal checkout path. On any other machine the write fails silently (caught at line 217), and where it succeeds it appends upgrade history including versions, the profile backup path and the rollback command to an unexpected location. It also leaks the author's local directory layout into the published package. Not exploitable by itself, but it is an unintended filesystem side effect on an attacker-influenced code path (the version string is embedded in the note).