Skip to content

fix(security): disable remote uninstall execution fallback #1476

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Saibabu7770 wants to merge 3 commits into
base: main
Choose a base branch
from
+16 −29
Open

fix(security): disable remote uninstall execution fallback #1476

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c06c544
fix(security): disable remote uninstall execution fallback
Apr 4, 2026
8426ed6
Merge branch 'main' into fix/uninstall-fallback-no-curl-pipe-577
Saibabu7770 Apr 4, 2026
007fd49
Merge branch 'main' into fix/uninstall-fallback-no-curl-pipe-577
Saibabu7770 Apr 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 6 additions & 29 deletions bin/nemoclaw.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -904,34 +904,11 @@ function uninstall(args) {
exitWithSpawnResult(result);
}

// Download to file before execution — prevents partial-download execution.
// Upstream URL is a rolling release so SHA-256 pinning isn't practical.
console.log(` Local uninstall script not found; falling back to ${REMOTE_UNINSTALL_URL}`);
const uninstallDir = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-uninstall-"));
const uninstallScript = path.join(uninstallDir, "uninstall.sh");
let result;
let downloadFailed = false;
try {
try {
execFileSync("curl", ["-fsSL", REMOTE_UNINSTALL_URL, "-o", uninstallScript], {
stdio: "inherit",
});
} catch {
console.error(` Failed to download uninstall script from ${REMOTE_UNINSTALL_URL}`);
downloadFailed = true;
}
if (!downloadFailed) {
result = spawnSync("bash", [uninstallScript, ...args], {
stdio: "inherit",
cwd: ROOT,
env: process.env,
});
}
} finally {
fs.rmSync(uninstallDir, { recursive: true, force: true });
}
if (downloadFailed) process.exit(1);
exitWithSpawnResult(result);
console.error(" Local uninstall script not found.");
console.error(" Remote uninstall fallback is disabled for security.");
console.error(` Download and review manually: ${REMOTE_UNINSTALL_URL}`);
console.error(" Then run: bash uninstall.sh [flags]");
process.exit(1);
}

function showStatus() {
Expand Down Expand Up @@ -1290,7 +1267,7 @@ function help() {
nemoclaw debug --output FILE Save diagnostics tarball for GitHub issues

Cleanup:
nemoclaw uninstall [flags] Run uninstall.sh (local first, curl fallback)
nemoclaw uninstall [flags] Run uninstall.sh (local only; no remote fallback)

${G}Uninstall flags:${R}
--yes Skip the confirmation prompt
Expand Down
10 changes: 10 additions & 0 deletions test/runner.test.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -746,4 +746,14 @@ describe("regression guards", () => {
expect(findJsViolations(src)).toEqual([]);
});
});

describe("uninstall fallback hardening (#577)", () => {
it("bin/nemoclaw.js does not execute remote uninstall script fallback", () => {
const src = fs.readFileSync(path.join(import.meta.dirname, "..", "bin", "nemoclaw.js"), "utf-8");
const uninstallBlock = src.split("function uninstall(args)")[1].split("function showStatus")[0];
expect(uninstallBlock).not.toMatch(/execFileSync\("curl"/);
expect(uninstallBlock).not.toMatch(/spawnSync\("bash", \[uninstallScript/);
expect(uninstallBlock).toContain("Remote uninstall fallback is disabled for security.");
});
});
});