Description

A security vulnerability has been detected in MauricioMilano coder-api up to 1.1.0. Affected is the function createProject of the file src/core/projects.ts of the component Projects Endpoint. The manipulation leads to command injection. The attack must be carried out locally. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-08T13:17:10.783Z",
  "pubdate": "2026-08-08T13:17:10.783Z",
  "executiveSummary": "A command injection vulnerability has been identified within the MauricioMilano coder-api component, specifically residing in the createProject function located in src/core/projects.ts. This security flaw affects product versions up to 1.1.0 and arises from improper neutralization of user-supplied input before it is passed to an underlying operating system shell or execution sink. Successful exploitation of this vulnerability allows a malicious actor to execute arbitrary system commands within the context of the application runtime environment.\nThe primary impact of this vulnerability includes complete system compromise, unauthorized execution of arbitrary code, potential data exfiltration, and manipulation of host resources. The risk implications are severe due to the direct access to system-level execution capabilities. Attacker capabilities require local access to the system hosting the application to successfully trigger and execute the attack vector. Exploitation requirements necessitate that the adversary has the ability to interact locally with the vulnerable Projects Endpoint and supply crafted input parameters to the createProject function. As the project maintainers have not responded to early issue reports regarding this vulnerability, systems utilizing affected versions remain at risk in the absence of official upstream patches.",
  "technicalDetails": "The root cause of the command injection vulnerability in MauricioMilano coder-api up to 1.1.0 stems from insecure handling of input parameters within the createProject function of the src/core/projects.ts file. The component fails to properly validate, sanitize, or escape data received through the Projects Endpoint before incorporating it into dynamic execution routines.\nThe vulnerable component is the Projects Endpoint, specifically handling project creation logic within src/core/projects.ts. Affected versions encompass all releases up to and including version 1.1.0. The attack vector requires local access to the target host running the application, and the exploitation does not explicitly depend on network exposure but relies on local privilege availability or local interaction capabilities.\nThe attack flow proceeds as follows: First, an attacker with local access crafts a malicious payload containing shell metacharacters or command separators designed to break out of the intended argument context of the execution sink. Second, the attacker invokes the createProject function via the Projects Endpoint, supplying the malicious payload within the vulnerable input parameter. Third, the application processes the request in src/core/projects.ts and concatenates or passes the unsanitized input directly to an underlying system shell or process execution function (such as child_process methods in Node.js environments). Fourth, the operating system interprets the injected command sequences alongside or instead of the intended operational commands.\nThe payload behavior results in the execution of arbitrary system commands with the privileges and permissions of the user running the Node.js application process. Post-exploitation impact includes the ability to read sensitive files, install persistent backdoors, pivot to internal network resources, manipulate project directories, and disrupt overall system integrity and availability. Given that authentication and specific privilege requirements are constrained by local access boundaries, any user or local process capable of interacting with the vulnerable endpoint can leverage this flaw to elevate their operational impact."
}