Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell() syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a parameter default such as shell(<command>), the command may be executed when the catalog source is accessed. This means that if a user loads a malicious catalog YAML, embedded commands could execute on the host system. Version 2.0.9 mitigates the issue by making getshell False by default everywhere.

Affected: PyPI: intake

### Summary The shell() syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a parameter default such as shell(<command>), the command may be executed when the catalog source is accessed. This means that if a user loads a malicious catalog YAML, embedded commands could execute on the host system. This behavior could potentially be classified as OS Command Injection / Unsafe Shell Expansion.

### Details The issue appears to originate from how parameter default values are expanded when a catalog source is accessed.

During catalog loading and source access:

Intake resolves parameter default values The function responsible for expanding defaults processes the shell() syntax The shell expression triggers a subprocess execution Because this occurs during catalog evaluation, the command may execute before the user explicitly interacts with the dataset itself.

Affected logic appears to involve: ``` expand_defaults() ``` and related parameter parsing mechanisms.

### PoC exploit.yaml ``` metadata: version: 1 sources: rce_test: driver: csv description: "Testing shell expansion in parameters" args: urlpath: "{{ cmd_exec }}" parameters: cmd_exec: display_name: "Test Parameter" type: str default: "shell(touch /tmp/intake_rce_test)" ```

reproduce.py ``` import intake import os

PROOF_FILE = "/tmp/intake_rce_test"

if os.path.exists(PROOF_FILE):…

python311-intake-2.0.9-1.1 on GA media

Affected: PyPI: intake

Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell() syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a parameter default such as shell(<command>), the command may be executed when the catalog source is accessed. This means that if a user loads a malicious catalog YAML, embedded commands could execute on the host system. Version 2.0.9 mitigates the issue by making getshell False by default everywhere.