Skip to content

fix(pmem): correct parent_uuid format specifier in args_dict #6283

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
buildearth wants to merge 1 commit into
base: master
Choose a base branch
from
+1 −1
Open

fix(pmem): correct parent_uuid format specifier in args_dict #6283

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion avocado/utils/pmem.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -463,7 +463,7 @@ def write_infoblock(self, namespace="", stdout=False, output=None, **kwargs):
"size": "-s %s",
"align": "-a %s",
"uuid": "-u %s",
"parent_uuid": "-p %",
"parent_uuid": "-p %s",
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist bot Mar 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

This change, while fixing a formatting bug for parent_uuid, introduces a command injection vulnerability. The parent_uuid value (and other user-provided inputs like namespace, output, and kwargs) is formatted into a command string and executed with shell=True without proper sanitization. If parent_uuid contains shell metacharacters (e.g., '; rm -rf /'), an attacker could execute arbitrary commands. To remediate, sanitize all user-provided values using shlex.quote() before formatting them into the command string. Alternatively, consider avoiding shell=True and passing the command and its arguments as a list to the execution function.

"offset": "-O %s",
}
args = ""
Expand Down
Loading