Hacker News Reader

Comment by neolog | Hacker News Reader

This "vulnerability" requires "able to set an environment variable on a Python execution environment" and "opening a browser leads to RCE". Once you have that level of control over a system, I don't think `antigravity` will make or break an RCE.

View on HN

I don't think you need a browser RCE. If you can set environment variables, can't you just change $BROWSER to point towards an arbitrary binary?

It does not require opening a browser, it can cause a browser to open.

Which is not on its own a "vulnerability", you'd need to chain it to something usable in the browser / as a consequence of the browser being opened.

It increases your options, certainly, but it can't do anything dangerous as-is.

You can define any executable in the $BROWSER environment variable which will be executed whenever antigravity is imported.

You could execute a 'curl` which directly pipes into 'bash -c'.

"Any executable" does not mean adding pipes and arguments. This is one important benefit of not using shell.

See https://github.com/python/cpython/blob/master/Lib/webbrowser...

This is flat wrong. You can cause it to run an arbitrary binary by setting the BROWSER environment variable, as they demonstrate in the article. They chained it with perl environment variable vulnerability listed earlier to achieve execution.

Yep, I misunderstood then - definitely vulnerable on its own!

Reply on news.ycombinator.com