Executive brief
Zenshin, a web and Electron-based anime streaming application, is vulnerable to a command injection flaw. An attacker can exploit this to execute arbitrary commands on a user's computer, potentially leading to full system compromise or data theft. This can be triggered either by a malicious website redirecting a user's browser to the local application or by direct network access if the application is exposed.
Technical details
An OS command injection vulnerability exists in Zenshin versions prior to 2.7.0 within the '/stream-to-vlc' Express route. The application improperly handles user-supplied input in the 'url' parameter by passing it directly to a 'child_process.exec' call without sufficient validation. Because 'child_process.exec' spawns a shell, an attacker can use shell metacharacters (such as '&') to escape the intended VLC command and execute arbitrary system commands. The vulnerability is exploitable remotely because the Express server binds to 0.0.0.0 by default, and it can also be triggered via cross-site request forgery (CSRF) style redirects from a malicious webpage. The issue was fixed in version 2.7.0 by replacing 'exec' with 'spawn' and binding the server to 127.0.0.1.
Affected products
- hitarth-gg Zenshin before 2.7.0
Timeline
- 2026-03-10: patched: Fix committed in version 2.7.0
- 2026-05-19: advisory: CVE-2026-37281 published