Command Execution via Drag-and-Drop in Terminal Emulators
Summary
Security researchers have identified a technique where terminal emulators can execute arbitrary commands when users drag and drop text containing shell commands, creating a potential social engineering attack vector.
Similar Articles
all the ways in which terminals' text rendering is bad (2024)
The article explores various fundamental problems with text rendering in terminal emulators, including character definition ambiguity, Unicode handling issues, flawed 2D grid assumptions, and cursor desyncs, highlighting the difficulty of supporting complex scripts and fonts.
Terminal Wrench: A Dataset of 331 Reward-Hackable Environments and 3,632 Exploit Trajectories
Researchers release Terminal Wrench, a dataset of 331 reward-hackable terminal environments with 3,632 exploit trajectories spanning sysadmin, ML, and security tasks.
Arbitrary code execution breaking sandboxes in KDE Plasma
A vulnerability in KDE Plasma allows sandboxed applications (e.g., Flatpak) to escape and execute arbitrary code on the host via the 'Open New Window' action, impersonating other applications. A proof of concept is provided.
Text files as a user interface
This article explores the concept of using a text editor as a user interface for command-line programs, highlighting how it leverages the editor's full editing capabilities while remaining simple to implement, with examples like crontab -e and a custom image gallery tool.
@EnoReyes: Btw because of droid shield this deterministically cannot happen with Droid. We regex all bash commands and then combin…
EnoReyes highlights that Droid Shield uses regex and small models to prevent accidental file deletion, in contrast to the reported incident with GPT-5.6-Sol.