# Config value interpolated into generated code

Config or restored settings spliced raw into generated source, command strings, or executed settings

_Area: Web injection and code execution. Seen in 3 disclosed reports; latest 2026-10-09. Updated 2026-10-24._

## How it works
A value that is supposed to be *data* (a path, host, filename, or restored setting) is treated as *syntax* when it is placed into generated source, a command string, or a live config file. The assumption that breaks is that config values are inert. They are not: a quote, a newline, or a directive keyword lets the value escape its slot and become executable code or configuration [E1](https://bugbountylibrary.com/r/h1%3A2701701.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-p393-cf76-4jmr.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-79fv-7hq9-w7xg.md).

## Where it shows up
- f-string or template code that places config values inside quoted literals in generated source, instead of `repr()`/`json.dumps()` [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-79fv-7hq9-w7xg.md)
- Config fields (paths, hosts, filenames) written into a generated config file without escaping for that file's syntax [E1](https://bugbountylibrary.com/r/h1%3A2701701.md)
- Restore/import handlers that copy attacker-supplied settings into the live config path [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-p393-cf76-4jmr.md)
- Integrity keys derived from key material the client also supplies [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-p393-cf76-4jmr.md)
- "Protected" settings that are only protected by a signature the attacker can recompute [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-p393-cf76-4jmr.md)

## How to review
Trace every config value from input to sink. The invariant: a value must be encoded for the target syntax (quoted/escaped for source, escaped for the config grammar, passed as an argument not a string for commands) before it is placed there. Check:
- Does the generator use `repr()`/`json.dumps()`/parameterized templates, or raw interpolation? [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-79fv-7hq9-w7xg.md)
- Does the config writer escape or reject syntax characters in path/host fields? [E1](https://bugbountylibrary.com/r/h1%3A2701701.md)
- Does restore validate settings against an allowlist before writing to the live path? [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-p393-cf76-4jmr.md)
- Is the integrity key independent of client-supplied material? [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-p393-cf76-4jmr.md)

## Variants seen
- Path field injected as raw nginx directives into generated nginx.conf [E1](https://bugbountylibrary.com/r/h1%3A2701701.md)
- Restored app.ini overwriting a command setting, then triggered via a test endpoint [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-p393-cf76-4jmr.md)
- Deploy config values spliced into generated Python source, executing on deploy [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-79fv-7hq9-w7xg.md)

## Why fixes fail
E1 notes that CVE-2021-25748 mitigations did not stop directive injection; blocking one directive (`by_lua`) was bypassed by staging a file and using `include` [E1](https://bugbountylibrary.com/r/h1%3A2701701.md). E2's signature check was defeated because the signing key was derived from the client's own key [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-p393-cf76-4jmr.md).

## Impact and severity
Led to remote code execution and service-account token theft [E1](https://bugbountylibrary.com/r/h1%3A2701701.md), authenticated RCE [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-p393-cf76-4jmr.md), and arbitrary Python execution on deploy [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-79fv-7hq9-w7xg.md). Severity is high: the sink runs with the service's privileges, and a single unescaped field is enough. Worse when the value reaches a live config path or a privileged command [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-p393-cf76-4jmr.md).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A2701701.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-p393-cf76-4jmr.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-79fv-7hq9-w7xg.md