dsh-xingye

Every route under /xingye/api is reachable without any token. Only requests carrying Sec-Fetch-Site: cross-site are rejected, so non-browser clients (header absent) pass, and a browser page whose origin resolves to the DSH port (DNS rebinding) or a same-site page is treated as trusted. /xingye/api/state returns the whole ui-state snapshot (all personas, user personas, session bindings, last messages, base64 images) and /xingye/api/prompt injects arbitrary text into the live agent session, where the agent's own tools can create/delete characters and archives and import local files.

Because '' is whitelisted, path.extname() === '' passes, so any readable extension-less file (e.g. /home/<user>/.ssh/id_rsa, /etc/passwd) is accepted by xingye_character / xingye_user_persona whenever the model is told to import that path. The content is copied to persona.md, injected into the system prompt, and the full persona text is then returned by the ui-state snapshot, forming an inject-then-exfiltrate chain with the unauthenticated prompt route.

Merely loading the plugin copies the bundled preset tree into $DSH_HOME/.agent-presets/xingye/ (outside the plugin's data dir), and /xingye/api/preset lets any caller pass {update:true} to overwrite those files with no authentication. Content is limited to the package's own preset files, so the impact is clobbering a locally edited preset / unexpected writes into DSH home, not arbitrary code injection.