security: [HIGH] Command injection risk via Slack user input to spawned process #3192
Description
File: .claude/skills/setup-spa/main.ts
Lines: 390-407
Severity: HIGH
Finding
User-controlled Slack messages are written directly to the stdin of a spawned claude CLI process without sanitization:
const proc = Bun.spawn(args, {
stdout: "pipe",
stderr: "pipe",
stdin: "pipe",
cwd: process.env.REPO_ROOT ?? process.cwd(),
env: {
...process.env,
SLACK_CHANNEL_ID: channel,
SLACK_THREAD_TS: threadTs,
...(userId ? { SLACK_USER_ID: userId } : {}),
},
});
proc.stdin.write(prompt); // <- prompt comes from buildThreadPrompt()
proc.stdin.end();The prompt variable (line 363) comes from buildThreadPrompt() which fetches user messages from Slack. While stdin is safer than shell interpolation, if the spawned claude CLI has any stdin parsing vulnerabilities or interprets special characters/control sequences, this could be exploited.
Impact
An attacker with access to the Slack workspace could:
- Inject control sequences or escape codes that might be interpreted by the
claudeCLI - Attempt to exploit any stdin parsing vulnerabilities in the subprocess
- Potentially execute arbitrary commands if the subprocess has such vulnerabilities
Attack Scenario
- Attacker sends a crafted Slack message containing control characters or escape sequences
- SPA bot processes the message via
buildThreadPrompt() - The prompt is written to
claudeCLI stdin without sanitization - If
claudeCLI mishandles the input, commands could execute
Recommendation
-
Validate and sanitize prompt content before writing to stdin:
- Strip or escape control characters (\x00-\x1F, \x7F)
- Implement maximum input size limits
- Validate UTF-8 encoding
-
Implement input sanitization in
buildThreadPrompt():function sanitizeForStdin(text: string): string { return text .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '') // Remove control chars .slice(0, MAX_PROMPT_LENGTH); // Enforce size limit }
-
Consider using structured input (JSON) instead of raw text if the
claudeCLI supports it -
Audit the
claudeCLI for stdin parsing vulnerabilities
-- security/code-scanner