New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remote Code Execution in the text box of Dalai #287

Open

mafen opened this issue Mar 26, 2023 · 1 comment · May be fixed by #320

mafen commented Mar 26, 2023

I was testing some of the texts from the https://github.com/ggerganov/llama.cpp and when i put It is $(date)

(date +%H:%M) outputted the current time

I also tested with command touch and the file was created in my docker container attached folder

Same goes for $(env)

myyk commented Mar 29, 2023

This fix if updated, looks promising to fix this: #138

myyk linked a pull request

that will close this issue

Stop using the shell to run commands #320

Open

mafen mentioned this issue

Dalai web interface arbitrary command execution via command back ticks #331

Open

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment