{
  "cve_id": "CVE-2026-37281",
  "ghsa_id": null,
  "target_component": "zenshin Electron/Express backend",
  "vulnerable_version": "< 2.7.0",
  "fixed_version": "2.7.0",
  "vulnerable_commit": "7d31c6edfbac978f0ad44c66d761bab9dcd2fa27~1",
  "fixed_commit": "7d31c6edfbac978f0ad44c66d761bab9dcd2fa27",
  "reproduction_result": "success",
  "vulnerability_validated": true,
  "fix_validated": true,
  "reproduction_indicators": {
    "vulnerable": {
      "endpoint_reachable": true,
      "status_code": 200,
      "response_snippet": "VLC launched successfully",
      "command_injection_confirmed": true,
      "artifact_created": "/tmp/pwned"
    },
    "fixed": {
      "endpoint_reachable": false,
      "status_code": 404,
      "response_snippet": "Cannot GET /stream-to-vlc",
      "command_injection_confirmed": false,
      "artifact_created": null
    }
  },
  "root_cause": "The /stream-to-vlc route in the vulnerable commit interpolated the unsanitized 'url' query parameter into a shell command executed via child_process.exec. Shell metacharacters in the URL were interpreted by the shell, allowing arbitrary command execution. The fix removed the Express endpoint entirely and replaced it with spawn using shell: false, passing the player path and URL as separate array arguments.",
  "reproduction_notes": "Reproduced by checking out the vulnerable commit, building the Electron backend with mocked Electron APIs, starting the Express server, and sending a crafted curl request with a shell injection payload (x\"; touch /tmp/pwned; echo \"x). The payload caused the file /tmp/pwned to be created, confirming arbitrary command execution. On the fixed commit, the same request returned 404, confirming the endpoint was removed and the vulnerability eliminated.",
  "timestamp": "2026-05-22T09:54:04Z"
}