## Ticket: CVE-2026-37281 — zenshin `/stream-to-vlc` OS command injection

**CVE**: CVE-2026-37281 | **CWE-78** (OS Command Injection)
**Severity**: Critical — CVSS 3.1 base 9.8 (AV:N/AC:L/PR:N/UI:N)
**Package**: `zenshin` (Electron/Express app) | **Repository**: https://github.com/hitarth-gg/zenshin

### Impact

`zenshin` is an Electron application with an Express HTTP backend. The backend
route **`/stream-to-vlc`** passes the `url` query parameter into a **shell
command without sanitization**. A crafted `url` value containing shell
metacharacters injects and executes **arbitrary shell commands** on the host —
remote code execution.

Any actor able to reach the local Express backend port can issue the request,
**unauthenticated**.

### Affected / fixed versions

Affected: `zenshin` `< 2.7.0`.
Fixed: **`2.7.0`**.

The fix ships in commit
[`7d31c6edfbac978f0ad44c66d761bab9dcd2fa27`](https://github.com/hitarth-gg/zenshin/commit/7d31c6edfbac978f0ad44c66d761bab9dcd2fa27).

Reproduce on the commit **immediately before** the fix and verify the fix on
commit **`7d31c6edfbac978f0ad44c66d761bab9dcd2fa27`** itself.

### Where to look

```bash
git clone https://github.com/hitarth-gg/zenshin.git
cd zenshin
git show 7d31c6edfbac978f0ad44c66d761bab9dcd2fa27          # the fix
git checkout 7d31c6edfbac978f0ad44c66d761bab9dcd2fa27~1    # vulnerable build
# ... and 7d31c6edfbac978f0ad44c66d761bab9dcd2fa27 for the fixed build
```

The fix commit changes how the `/stream-to-vlc` route handles the `url`
parameter — confirm the root cause is the unsanitized interpolation of `url`
into a shell command.

### Reproduction approach

No database or browser is needed — only the Express backend and `curl`. The
Electron front-end is not required.

1. Check out the **vulnerable** ref (parent of the fix commit).
2. Install backend dependencies (`npm install`) and start the Express backend
   so its HTTP port is reachable.
3. Send a request with an injected command:
   `curl 'http://localhost:<port>/stream-to-vlc?url=;touch /tmp/pwned'`
4. Check whether the sentinel file `/tmp/pwned` was created.
5. Repeat with the **fixed** ref `7d31c6edfbac978f0ad44c66d761bab9dcd2fa27`.

### Expected result

| Build | `curl '.../stream-to-vlc?url=;touch /tmp/pwned'` | `/tmp/pwned` |
|-------|--------------------------------------------------|--------------|
| pre-fix commit (vulnerable) | unsanitized `url` concatenated into a shell command and executed | **created** — injected command ran |
| `7d31c6edfbac978f0ad44c66d761bab9dcd2fa27` (fixed) | `url` no longer reaches a shell unsanitized | **not created** — injected command did not run |

- **Vulnerable indicator**: `/tmp/pwned` exists after the request — the
  injected command executed.
- **Fixed indicator**: `/tmp/pwned` is absent — the command did not run.

### Expected artifacts

- `reproduction_steps.sh` — checks out both refs, installs dependencies,
  starts the Express backend, issues the `curl` request, and checks for the
  sentinel file.
- `validation_verdict.json` — `verdict: confirmed`, with the vulnerable and
  fixed indicators captured.
- Logs capturing the backend output and the `/tmp/pwned` presence check for
  each ref.