关键漏洞信息 漏洞名称 Command Injection via Unsanitized User Input (Low) 漏洞ID GHSA-44q9-rg2q-5g99 影响版本 =3.11.3 严重性 Low (0.0 / 10) 描述 Shell installer scripts process the installation prefix (user_prefix) using an eval statement, which executes unsanitized user input as shell code. 影响 Although the script runs with user privileges (not root), an attacker could exploit this by injecting arbitrary commands through a malicious path during installation. Exploitation requires explicit user action (e.g., manually entering a malicious path), similar to self-XSS in browsers. 修复措施 Coming. The fix is trivial. 解决方法 Not typing the malicious path 参考资料 Discovered by Miniforge audits done by 7a Security in partnership with OSTIF.