coda-cli@1.8.6
一款支持完全离线部署的研发效能一体化命令行助手
AI Security Review
scanned 20h ago · by lpm-firewall-aiThe optional agent server binds to all interfaces and exposes chat-driven file tools. A flawed path-prefix check can allow access to sibling paths, so this is a security vulnerability warranting a warning, though it is not evidence of malicious intent.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs the CLI’s agent server start command, then a network-accessible client sends a chat request.
Impact
A reachable client may read or overwrite files in sibling directories accessible to the server process.
Mechanism
The server binds to 0.0.0.0. Chat requests can invoke file tools. The path guard uses a string-prefix check that can accept a sibling path whose name begins with the workspace path.
AI rationale
The optional agent server binds to all interfaces and exposes chat-driven file tools. A flawed path-prefix check can allow access to sibling paths, so this is a security vulnerability warranting a warning, though it is not evidence of malicious intent.
Evidence
packages/coda-agent-server/main.jsbin/index.js../<sibling path>
Network endpoints2
0.0.0.0:10086/api/chat/completions
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Critical Vulnerability with medium false-positive risk.
Evidence for warning
- The agent server binds to 0.0.0.0, making it reachable on all network interfaces when started.
- Its path guard checks a resolved path with startsWith(root), which can accept a sibling path sharing the workspace path prefix.
- The chat endpoint accepts a prompt and passes it to the agent service; the server exposes read and write file tools that resolve user-supplied paths.
- The server requires an explicit start command, so this exposure occurs when a user starts the agent server.
Evidence against
- The server’s file tools are presented as workspace management features for the local AI agent.
- The package has no install lifecycle scripts.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
6 flaggedbin/index.jsView file
1#!/usr/bin/env node
L2: (()=>{"use strict";var e={996(e,t,a){t.childProcess=void 0;const s=a(317);t.childProcess={runCmdLive:(e,t=process.cwd())=>new Promise(a=>{const n=(0,s.spawn)(e,{cwd:t,stdio:"inheri...
L3: //# sourceMappingURL=index.js.map
High
1#!/usr/bin/env node
L2: (()=>{"use strict";var e={996(e,t,a){t.childProcess=void 0;const s=a(317);t.childProcess={runCmdLive:(e,t=process.cwd())=>new Promise(a=>{const n=(0,s.spawn)(e,{cwd:t,stdio:"inheri...
L3: //# sourceMappingURL=index.js.map
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/index.jsView on unpkg · L1generator/chat/index.jsView file
1#!/usr/bin/env node
L2: (()=>{"use strict";var e={996(e,t,a){t.childProcess=void 0;const s=a(317);t.childProcess={runCmdLive:(e,t=process.cwd())=>new Promise(a=>{const n=(0,s.spawn)(e,{cwd:t,stdio:"inheri...
L3: //# sourceMappingURL=index.js.map
Findings
4 High4 Medium4 Low
HighChild Processbin/index.js
HighSame File Env Network Executionbin/index.js
HighCommand Output Exfiltrationgenerator/chat/index.js
HighShips High Entropy Blobpackages/coda-vscode-chat/coda-vscode-chat-1.0.0.vsix
MediumNetwork
MediumEnvironment Vars
MediumShips Compressed Blobpackages/coda-vscode-chat/coda-vscode-chat-1.0.0.vsix
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNested Archive Needs Inspectionpackages/coda-vscode-chat/coda-vscode-chat-1.0.0.vsix
Affected versions and remediation
This report applies to coda-cli@1.8.6.
See all versions of coda-cli for other recorded verdicts.
- Review the evidence and your use of coda-cli@1.8.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.