GPT-Pilot Command Injection Vulnerability Allowing Remote Code Execution

A command injection vulnerability has been identified in GPT-Pilot, specifically in the Executor.run() method, prior to commit 0819827ce20346ef5f25b3fe29293cb448840565. This vulnerability allows for remote code execution by injecting arbitrary shell commands. The issue arises because the application accepts free-text input without proper validation, which is then directly passed to asyncio.create_subprocess_shell() for execution. As a result, an attacker can manipulate the intended command and execute malicious code with the same privileges as the GPT-Pilot process.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where GPT-Pilot is running, with the same user privileges as the GPT-Pilot process.