@likhonmain/voice-input

Any web page the victim visits can fetch http://127.0.0.1:<port>/api/voice-input/config and read the full config, including apiKey, url and model, because responses carry wildcard CORS and there is no auth check. The same route accepts unauthenticated POSTs, letting a page overwrite the provider URL (redirecting future audio/keys to an attacker). client.js even advertises the harness port 43129.

The request-supplied `format` is concatenated into the filename and path.join-normalized, so values containing path separators and '..' escape the Crashed Recording directory. saveCrashedRecording runs whenever transcription fails (attacker sets body.url to an unreachable host to force failure), writing attacker-controlled base64 bytes to an attacker-chosen path on the host.

apply() unconditionally rewrites the installed Electron app.asar, editing its permission whitelist to grant 'media' without any user action or disclosure. This tampers with another application's binaries, bypasses its security model, and risks corrupting the desktop app if the byte pattern no longer matches.

Because the endpoint is unauthenticated and CORS-open, a cross-origin page can make the host process POST to arbitrary internal URLs with attacker-controlled Authorization headers; up to 300 bytes of the target response are echoed back via errors.push(`... ${errText.slice(0, 300)}`), enabling limited SSRF/response disclosure.

A user who runs this manual helper modifies the installed DSH Desktop binary to widen its permission whitelist. Although it is opt-in, creates a backup and requires an argument, it weakens the desktop permission model and can break the app on pattern mismatch.