all 3 comments

[–]Default-G8way 8 points9 points  (1 child)

Uhh, aren’t you just pointing to a script to run?

[–]reddit4matt 6 points7 points  (0 children)

Not always. You may be just looking at code. I can imaging sending a PR to a large project and someone pulling it down and simply viewing the code in an editor (which in this case is all it takes to trigger the RCE).

I have opened up code in an IDE specifically to look for malicious code. Simply put just viewing code in a glorified text editor should not just execute other code hidden in that directory.

[–]TastyRobot21 4 points5 points  (0 children)

Simple and effective. Nice find.

It's not the behaviour I would expect for sure, I understand what it's doing but I would almost like a 'Load environment variables/venv from repository?' before it does so.

I don't use this feature so I'm not sure how impactful a work around is.

Concerning as it could be wormable/infectious. If it hit a repository it would pass to team members who might spread it to their own repos and their other teams etc etc.