{"action":"closed","issue":{"url":"https://api.github.com/repos/feross/cross-zip/issues/1","repository_url":"https://api.github.com/repos/feross/cross-zip","labels_url":"https://api.github.com/repos/feross/cross-zip/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/feross/cross-zip/issues/1/comments","events_url":"https://api.github.com/repos/feross/cross-zip/issues/1/events","html_url":"https://github.com/feross/cross-zip/issues/1","id":148840669,"number":1,"title":"[security] missing escaping for shell filenames","user":{"login":"mappu","id":3959202,"avatar_url":"https://avatars.githubusercontent.com/u/3959202?v=3","gravatar_id":"","url":"https://api.github.com/users/mappu","html_url":"https://github.com/mappu","followers_url":"https://api.github.com/users/mappu/followers","following_url":"https://api.github.com/users/mappu/following{/other_user}","gists_url":"https://api.github.com/users/mappu/gists{/gist_id}","starred_url":"https://api.github.com/users/mappu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mappu/subscriptions","organizations_url":"https://api.github.com/users/mappu/orgs","repos_url":"https://api.github.com/users/mappu/repos","events_url":"https://api.github.com/users/mappu/events{/privacy}","received_events_url":"https://api.github.com/users/mappu/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/feross/cross-zip/labels/bug","name":"bug","color":"ee0701"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-04-16T10:40:53Z","updated_at":"2016-05-02T20:44:20Z","closed_at":"2016-05-02T20:44:20Z","body":"Can cause remote code execution if there is a code path to an attacker-supplied filename.\r\n\r\nPOC (Windows): put `'` in filename.\r\n\r\nPOC (Other): put space or `&` or `|` in filename.\r\n\r\nSince this library is the access point for shell execution, it's this library's responsibility to mangle file paths for the shell, not the caller's responsibility."}}