MonkeyCode 桌面客户端存在RCE漏洞
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 4.7k
- Forks
- 719
- Avg merge
- 4h 30m
- Merged PRs (30d)
- 83
Description
MonkeyCode 桌面端的「设计预览」功能会把工作区中的 HTML 文件加载进一个主窗口的子 webview。由于该应用的 Tauri 能力（capability）声明使用 windows: ["main"] 而未限定 webviews，而 Tauri 的语义是「窗口匹配则授予该窗口下所有webview」，导致这个渲染不可信内容的预览 webview 继承了与主界面完全相同的特权 IPC 权限。
攻击者只需让一个包含恶意 JavaScript 的 HTML 文件出现在受害者的会话工作区（例如放在一个公开 Git 仓库里，由受害者的 AI 助手克隆下来），并在受害者点击一次「预览」标签页后即可执行任意代码——包括调用宿主 shell 执行命令、读取任意路径文件。
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the Tauri capability declaration that uses windows: ["main"], then trace how the design-preview HTML is loaded into its child webview. Verify the preview does not inherit the main window's privileged IPC access, including shell execution and arbitrary file reads, while the main interface remains functional.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- tauri, typescript
- Domain
- desktop, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100