Submission Details
Severity:
FFI enabled by default
Summary
Arbitrary commands could be run leading to security risks for user running the test suite.
Vulnerability Details
The test suite have a testPwned that use ffi which allow to execute an arbitrary command on the user machine.
It can lead to security risks.
Impact
Potential malicious arbitrary commands run.
Tools Used
Manual review
Recommendations
Deactivate ffi by default. Run tests inside in an isolated environment.
Rewards breakdown
This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.