CVE-2020-7625

An attacker can inject arbitrary OS commands by providing a malicious string as the URL argument to the `open` function [ref_id=2]. The input is concatenated into a shell command without neutralization, so shell metacharacters such as `&` allow command chaining [CWE-78]. For example, passing `'& touch Song'` as the URL causes the `touch` command to execute on the system [ref_id=2]. No authentication or special network position is required; the attacker only needs to control the URL parameter passed to the library.

The vulnerable code is in `lib/index.js` at line 75 [ref_id=1]. The `url` function passes user-supplied input directly into a command string that is executed via `exec` or `execSync` without sanitization [ref_id=2].

The fix replaces all uses of `exec` and `execSync` with `execFile` and `execFileSync` [ref_id=2]. Unlike `exec`, `execFile` does not spawn a shell, so shell metacharacters in the input are treated as literal arguments rather than command separators. This prevents an attacker from chaining arbitrary commands through the URL parameter. No other code changes are needed because the root cause was the use of a shell-based execution function.

Create a file `poc.js` with the following content:

```js var root = require("op-browser"); root.open('chrome','& touch Song','',''); ```

Run `node poc.js`. After execution, a file named `Song` will be created in the current directory, confirming command injection [ref_id=2].