# Untrusted binary path to exec

Config or request fields naming a binary, entry class or args reach exec without an allowlist

_Area: Web injection and code execution. Seen in 3 disclosed reports; one confirmed bounty: $6,000; latest 2026-10-06. Updated 2026-10-24._

## How it works
Code treats a value that names *what to execute* as ordinary configuration or request data. A binary path, entry class, or argument list is read from a config file or API body and handed to a process-spawning call. The broken assumption: that the value is trusted because it lives in a config file or passed a validation step. When the validator only checks the value against another attacker-controlled value, or checks unrelated fields, nothing constrains what actually runs.

## Where it shows up
- Config fields naming an executable or interpreter path (e.g. an LSP `Binary` setting) flowing into `exec.LookPath` or spawn calls [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-mc52-mwq4-vfx3.md)
- API routes accepting a `binary` plus a command/args field, then spawning them [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-hf57-cqmx-p4gr.md)
- Job-submission or plan endpoints accepting `entry-class` and `programArg` that load any classpath class [E1](https://bugbountylibrary.com/r/h1%3A1418891.md)
- Validators that compare two user-supplied fields to each other (command's first token vs binary) [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-hf57-cqmx-p4gr.md)
- `Validate()`/`resolve()` functions that skip the executable field entirely [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-mc52-mwq4-vfx3.md)
- `LookPath` accepting absolute or slash-containing paths, bypassing PATH assumptions [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-mc52-mwq4-vfx3.md)

## How to review
Trace every value that reaches a spawn, `execFileSync`, `LookPath`, or class-loading call back to its source. The invariant: the executable/class/args must be selected from a fixed allowlist the attacker cannot influence, not merely validated for self-consistency. Check that validation covers the executable field itself, that absolute and slash-containing paths are rejected or resolved against a managed directory, and that entry-class/arg parameters are constrained to known-safe values. Confirm the route's auth gate actually applies (e.g. `requireLogin`).

## Variants seen
- Arbitrary classpath class via entry-class + args on a plan endpoint [E1](https://bugbountylibrary.com/r/h1%3A1418891.md)
- Attacker binary + args via API, guard vacuous [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-hf57-cqmx-p4gr.md)
- Config-file binary path trusted by editor tooling, executed on repo open [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-mc52-mwq4-vfx3.md)

## Impact and severity
All three reached remote or local code execution, including anonymous RCE when auth was disabled [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-hf57-cqmx-p4gr.md) and execution triggered simply by opening a malicious repo [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-mc52-mwq4-vfx3.md). Severity is high to critical. Worse when the endpoint is unauthenticated [E1](https://bugbountylibrary.com/r/h1%3A1418891.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-hf57-cqmx-p4gr.md) or the trigger is automatic (repo open, cache refresh) [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-hf57-cqmx-p4gr.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-mc52-mwq4-vfx3.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1418891.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-hf57-cqmx-p4gr.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-mc52-mwq4-vfx3.md