News for hackers. Stuff that matters.

A comment on Acme.sh runs arbitrary commands from a remote server. Parent comment

Re:Acme.sh runs arbitrary commands from a remote server by pazderski on Friday June 09, 2023 @05:18AM (#36255296)
I wouldn't say there are too many pitfalls. Quote all variables (acme.sh seem to do well on that part) and don't use eval (probably the reason for this problem).
[ Parent | on HN ]
Re:Acme.sh runs arbitrary commands from a remote server by Eeems on Friday June 09, 2023 @11:20AM (#36259171)
I just read the entire issue thread, yes eval was the reason.
[ Parent | on HN ]