# Config value into executable sink

Restored or user-editable config values reaching command strings, module loads, or generated code

_Area: Web injection and code execution. Seen in 3 disclosed reports; one confirmed bounty: $3,000; latest 2026-10-09. Updated 2026-10-24._

## How it works
A value that looks like data (a config setting, a directive field, a YAML key) is treated as trusted and spliced into something that executes: a shell command, a module load, or generated markup. The broken assumption is that config is safe because it is "protected" or "internal." When an attacker can write that value — through a restore path, a user-supplied JSON directive, or a YAML file — the sink runs their content. Integrity checks and gates only help if they are not derived from, or bypassable by, the same attacker-controlled input.

## Where it shows up
- Restore/import handlers that copy uploaded config into the live config path [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-p393-cf76-4jmr.md)
- Manifest or signature keys derived from client-supplied key material [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-p393-cf76-4jmr.md)
- Config fields holding command strings, module paths, or code templates [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-p393-cf76-4jmr.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-78r8-wwqv-r299.md)
- Library code merging user JSON into config, then writing to `innerHTML`/`<style>` [E2](https://bugbountylibrary.com/r/h1%3A1103258.md)
- `spec_from_file_location` + `exec_module`, `eval`, `pickle.loads` fed from config files [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-78r8-wwqv-r299.md)
- A security gate applied at one call site but not its siblings [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-78r8-wwqv-r299.md)

## How to review
Trace every config value that reaches an executable sink and ask: who can write it, and what checks stand between write and execution? The invariant: no attacker-writable value may reach a command, module load, or code/markup sink without an allowlist or escaping that does not depend on attacker-supplied material. For restore paths, verify the signing key is server-held, not derived from the uploaded backup [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-p393-cf76-4jmr.md). For generated CSS/markup, confirm user fields are escaped so tag breakout is impossible [E2](https://bugbountylibrary.com/r/h1%3A1103258.md). For module loaders, confirm the gate wraps the sink itself, not just one caller [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-78r8-wwqv-r299.md).

## Variants seen
- Backup restore overwriting protected command settings, with forgeable manifest signature [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-p393-cf76-4jmr.md)
- User JSON directive merged into CSS and injected via `innerHTML`, enabling `</style>` breakout [E2](https://bugbountylibrary.com/r/h1%3A1103258.md)
- YAML-supplied module path executed via unguarded `exec_module`, bypassing an env-var gate [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-78r8-wwqv-r299.md)

## Why fixes fail
E3 shows a chokepoint refactor that gated one `exec_module` sink while two sibling sinks in another file stayed open; the same dangerous API must be enumerated everywhere [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-78r8-wwqv-r299.md). E1 shows a signature that is worthless because its key comes from the same client input it is meant to protect [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-p393-cf76-4jmr.md).

## Impact and severity
Authenticated remote code execution in server products [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-p393-cf76-4jmr.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-78r8-wwqv-r299.md); stored DOM XSS in a shared issue renderer [E2](https://bugbountylibrary.com/r/h1%3A1103258.md). Severity rises when the sink runs with server privileges, when the gate is bypassable, and when the payload persists for other users.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-p393-cf76-4jmr.md
- E2: https://bugbountylibrary.com/r/h1%3A1103258.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-78r8-wwqv-r299.md