dsh-vision-bridge

POST /vision-bridge/config accepts any string for apiKeyEnv (clean[key] = patch[key], line 988) and any baseUrl, and /vision-bridge/test then calls the endpoint with 'Authorization': `Bearer ${apiKey}` (line 172). The referenced value is resolved from the DSH credential store (state.credentials.resolve, line 335) or from process.env, so a caller can name an unrelated secret (e.g. AWS_SECRET_ACCESS_KEY or another provider's credential reference) and have it transmitted to an attacker-chosen host. Protected only by sameOrigin() and reachable by any non-browser local client.

execute() passes args.path straight to loadImageSource; there is no extension/type allow-list, guessMime defaults unknown extensions to 'image/png' (line 142), and the bytes are base64-inlined into the outbound request (line 609) or saved as an attachment and sent to the configured provider. A prompt-injected model can therefore request e.g. ~/.ssh/id_rsa, ~/.dsh/settings.yaml or .env and have the content shipped off-host; there is also no size cap on this path (the 25 MB PASTE_MAX_BYTES limit applies only to the paste route), so a huge file causes unbounded memory use.

writeSettingsSection() serializes string values verbatim; a value containing a newline (e.g. baseUrl = "https://x\notherKey: value") inserts unindented lines, i.e. new top-level keys into the host's settings.yaml, which is then rewritten to disk (line 403). Values come from POST /vision-bridge/config, which only checks syntax for providerMode/timeout and copies any other field as-is (line 988). This gives the config route a write primitive on the whole host settings file, not just the vision-bridge section.

All state-changing routes (paste, config POST, test) accept requests with no Sec-Fetch-Site header, so older browsers and any non-browser local client bypass the only CSRF guard; combined with the findings above this is the precondition that makes the config write and credential redirection reachable.