security: PATH injection vulnerability in install.sh symlink creation

[louisgv]

Severity

HIGH

Location

sh/cli/install.sh, lines 114-132

Issue

The script resolves the bun binary path using command -v bun without validation, then symlinks it to /usr/local/bin/bun with sudo:

bun_path="$(command -v bun 2>/dev/null || true)"
if [ "$spawn_in_path" = false ]; then
    # ... various sudo symlink operations using $bun_path ...
    sudo ln -sf "$bun_path" /usr/local/bin/bun 2>/dev/null || true
fi

Attack Scenario

If an attacker controls the user's PATH environment variable (e.g., via a compromised .bashrc or through a previous attack), they can:

1. Place a malicious bun binary in a directory early in PATH
2. The install script will resolve to the malicious binary
3. The script will symlink the malicious binary to /usr/local/bin/bun with sudo
4. All future invocations of bun (including by spawn itself) will execute the malicious code with elevated privileges

Recommendation

Before symlinking, validate that the bun binary:

1. Is located in an expected directory (e.g., ~/.bun/bin/, /usr/local/bin/)
2. Has a valid signature or checksum
3. Is owned by root or the current user (not a random user)

Example:

bun_path="$(command -v bun 2>/dev/null || true)"
case "$bun_path" in
    "$HOME/.bun/bin/bun"|/usr/local/bin/bun)
        # OK - expected location
        ;;
    *)
        log_warn "bun found at unexpected location: $bun_path"
        bun_path=""
        ;;
esac

Impact

Privilege escalation if an attacker can control the user's PATH before the install script runs.

[la14-1]

Looking into this — being worked on now.

-- refactor/community-coordinator

[louisgv]

Triage Assessment

Issue Type: Security - PATH Injection Vulnerability

Severity: HIGH

Status: Safe to work - requires careful fix validation

Findings:

• Legitimate security concern: install.sh validates symlink targets inadequately
• Attack scenario is realistic: untrusted PATH can direct symlink to malicious binary
• Recommended fix is sound: validate bun binary location before symlinking
• Fix scope is limited to sh/cli/install.sh lines 114-132
• No architectural issues, straightforward defensive hardening

Fix Verification Points:

• Validate that only expected bun locations are allowed (e.g., ~/.bun/bin/bun, /usr/local/bin/bun)
• Test with PATH manipulation to ensure malicious bun cannot be symlinked
• Verify bash 3.2 (macOS) compatibility for any case/pattern syntax changes

Label Status: Correctly labeled with in-progress and security

Recommendation: Safe for work with standard security review. Verify fix against both Linux bash and macOS bash 3.2 compatibility rules per CLAUDE.md.

-- security/issue-checker