coda-cli@1.8.5
一款支持完全离线部署的研发效能一体化命令行助手
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe unauthenticated file-operation API is exposed on all network interfaces, creating a serious risk of remote workspace disclosure or modification. This is a vulnerability in the agent server's network exposure, so the package should be warned on rather than blocked as malicious.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the chat command, which starts the server automatically, or explicitly starts the server.
Impact
A reachable network client could read project files or tamper with workspace contents.
Mechanism
The server binds to 0.0.0.0 and accepts MCP execute requests that can read or write workspace files without authentication.
AI rationale
The unauthenticated file-operation API is exposed on all network interfaces, creating a serious risk of remote workspace disclosure or modification. This is a vulnerability in the agent server's network exposure, so the package should be warned on rather than blocked as malicious.
Evidence
packages/coda-agent-server/main.jsgenerator/chat/index.jsWorkspace paths selected through MCP tool arguments
Network endpoints2
0.0.0.0:10086/api/mcp/execute
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- The agent server listens on 0.0.0.0, exposing it on all network interfaces.
- The server exposes POST /api/mcp/execute without an authentication guard in the controller.
- The endpoint can read and write files in the server's current working directory.
Evidence against
- The CLI is described as a local AI coding assistant, and chat starts the companion server after the user invokes the chat command.
- The file tools are intended for workspace management and include a workspace path boundary check.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggedbin/index.jsView file
1#!/usr/bin/env node
L2: (()=>{"use strict";var e={996(e,t,a){t.childProcess=void 0;const s=a(317);t.childProcess={runCmdLive:(e,t=process.cwd())=>new Promise(a=>{const n=(0,s.spawn)(e,{cwd:t,stdio:"inheri...
L3: //# sourceMappingURL=index.js.map
High
1#!/usr/bin/env node
L2: (()=>{"use strict";var e={996(e,t,a){t.childProcess=void 0;const s=a(317);t.childProcess={runCmdLive:(e,t=process.cwd())=>new Promise(a=>{const n=(0,s.spawn)(e,{cwd:t,stdio:"inheri...
L3: //# sourceMappingURL=index.js.map
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/index.jsView on unpkg · L1generator/chat/index.jsView file
1#!/usr/bin/env node
L2: (()=>{"use strict";var e={996(e,t,a){t.childProcess=void 0;const s=a(317);t.childProcess={runCmdLive:(e,t=process.cwd())=>new Promise(a=>{const n=(0,s.spawn)(e,{cwd:t,stdio:"inheri...
L3: //# sourceMappingURL=index.js.map
Findings
4 High4 Medium4 Low
HighChild Processbin/index.js
HighSame File Env Network Executionbin/index.js
HighCommand Output Exfiltrationgenerator/chat/index.js
HighShips High Entropy Blobpackages/coda-vscode-chat/coda-vscode-chat-1.0.0.vsix
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobpackages/coda-vscode-chat/coda-vscode-chat-1.0.0.vsix
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNested Archive Needs Inspectionpackages/coda-vscode-chat/coda-vscode-chat-1.0.0.vsix
Affected versions and remediation
This report applies to coda-cli@1.8.5.
See all versions of coda-cli for other recorded verdicts.
- Review the evidence and your use of coda-cli@1.8.5 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.