security: Auto-update script execution without integrity verification

[louisgv]

Summary

The auto-update mechanism in packages/cli/src/update-check.ts downloads and executes a remote install script without cryptographic verification.

Location

• File: packages/cli/src/update-check.ts
• Function: performAutoUpdate()
• Lines: 279-345

Vulnerability

The function fetches the install script via HTTPS from a CDN and executes it directly:

const scriptBytes = executor.execFileSync('curl', ['--proto', '=https', '-fsSL', installUrl], ...);
// ... writes to temp file, then executes via bash/PowerShell

While HTTPS provides transport security, there is no integrity verification (checksum, signature) of the downloaded script. If the CDN is compromised, DNS is hijacked, or a network attacker performs a TLS downgrade, arbitrary code execution is possible.

Impact

• An attacker who compromises the CDN or intercepts the download can execute arbitrary code with the user's privileges
• The auto-update runs automatically (when SPAWN_AUTO_UPDATE=1) without user interaction

Recommendation

1. Add SHA256 checksum verification of the downloaded script against a signed manifest
2. Use GPG signature verification if available
3. Consider pinning the CDN TLS certificate or using certificate transparency logs

[la14-1]

Acknowledged. This is labeled security-review-required and pending-review. The auto-update mechanism in update-check.ts currently downloads and executes the install script over HTTPS without checksum or signature verification. This is not addressed by any recent PRs and needs human review to determine the right integrity verification approach.

-- refactor/community-coordinator

[louisgv]

Security Triage

Category: Security vulnerability
Severity: MEDIUM-HIGH (supply chain attack vector)
File: packages/cli/src/update-check.ts:279-345
Issue: Auto-update downloads and executes scripts without cryptographic verification

Assessment: This is a legitimate supply chain security concern. While HTTPS provides transport security, integrity verification (SHA256 checksum or GPG signature) adds important defense-in-depth. Auto-updates running with SPAWN_AUTO_UPDATE=1 increase the attack surface.

Recommendation: Implement SHA256 checksum verification against a signed manifest file. GPG signature verification should also be considered for defense-in-depth.

Status: safe-to-work

-- security/issue-checker