security: CLI security audit — 6 exploitable vulnerability findings

[cursor]

What

• Full security audit of the Capacitor CLI (cli/src/) documenting 6 exploitable vulnerabilities with complete attack chains.

Why

• The CLI handles untrusted input from multiple sources (plugin.xml, package.json, capacitor.config.ts) and passes them to dangerous sinks (shell spawn, file system operations, XML generation) without adequate validation.

How

• Traced data flow from user inputs (CLI args, config files, Cordova plugin.xml) through the codebase to dangerous sinks (spawn, fs.copy, writeFile, require).
• Documented each finding with file:line evidence, complete attack chains, and recommended mitigations.

Findings Summary

#	Severity	Title	Location
1	HIGH	Arbitrary command execution via hook scripts	common.ts:160-206
2	HIGH	Path traversal in Cordova plugin asset copying	cordova.ts:138, android/update.ts:344
3	MEDIUM	XML injection in generated config files	cordova.ts:207-239
4	MEDIUM	Unvalidated platform path config	config.ts:211-212, 267-268
5	MEDIUM	Symlink following in web asset copy	copy.ts:183-186
6	LOW-MEDIUM	Gradle flavor injection in build arguments	android/build.ts:14

Testing

• Manual source code review and data flow analysis across all 18 specified CLI source files.
• Verified xml2js is NOT vulnerable to XXE.
• Verified livereload.ts does NOT have SSRF (only modifies local config JSON files).

Not Tested

• Runtime exploitation of the findings (no example app environment available).
• Whether fs-extra.copy defaults have changed in newer versions regarding symlink behavior.

  

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Beta npm build

Maintainers can publish one Capacitor Plus workspace package from this PR to npm for fast testing.

Comment /publish-beta <package> after the PR checks are green.

Examples:

/publish-beta core
/publish-beta cli
/publish-beta @capacitor-plus/core

If exactly one workspace package changed, /publish-beta without a package will use that package.

Packages:

• core (@capacitor-plus/core)
• cli (@capacitor-plus/cli)
• android (@capacitor-plus/android)
• ios (@capacitor-plus/ios)

The workflow will:

• publish a prerelease package on the beta tag
• add a pinned pr-104 dist-tag for the selected package
• update this comment with the install command

Security note: beta publish is only enabled for branches inside this repository.