[GH-ISSUE #6956] [Bug] trace_dylib_resolution can resolve candidates outside the analyzed root on Windows #4248

New issue

Closed

opened 2026-10-31 00:48:04 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:48:04 +00:00

Owner

Originally created by @Adolanium on GitHub (Oct 24, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6956

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

On a Windows host, trace_dylib_resolution can report a dyld candidate as resolved to a file outside the analyzed root, and include that file in its images and digests. This happens when a load path component contains \, which macOS treats as an ordinary file-name character.

Reproduction

Ran on Windows 11, Node 24.22.1, at upstream/main bcd18d289, through stdio MCP in a test:

Create analyzed/app, a Mach-O executable with an LC_LOAD_DYLIB whose path contains \ components, and a Mach-O dylib in a sibling directory outside analyzed/.
open_binary on analyzed/app, then trace_dylib_resolution.
The result includes the sibling dylib, outside the analyzed root.

Expected behavior

Candidates stay inside the analyzed root on every host, as they do on macOS and Linux. A component that cannot name a file in the root is reported as absent.

Impact and scope

Windows hosts only. A traced bundle can make REA read and hash a file outside the directory the caller selected.

REA version

6.7.0, revision bcd18d289

Runtime and platform

Windows 11, Node 24.22.1

Target and artifact context

Synthetic Mach-O fixtures; no real application.

Interface

MCP

Earliest failure stage

Artifact or evidence registration

Relevant output or evidence

Root cause and fix are in #6955, with the regression tests.

Typed outcome or recovery expected

No new error. The candidate is absent.

Analysis or suspected cause

Root cause and fix are in #6955.

Additional context

Fixed by #6955.

Originally created by @Adolanium on GitHub (Oct 24, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6956 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior On a Windows host, `trace_dylib_resolution` can report a dyld candidate as resolved to a file outside the analyzed root, and include that file in its images and digests. This happens when a load path component contains `\`, which macOS treats as an ordinary file-name character. ### Reproduction Ran on Windows 11, Node 24.22.1, at upstream/main bcd18d289, through stdio MCP in a test: 1. Create `analyzed/app`, a Mach-O executable with an `LC_LOAD_DYLIB` whose path contains `\` components, and a Mach-O dylib in a sibling directory outside `analyzed/`. 2. `open_binary` on `analyzed/app`, then `trace_dylib_resolution`. 3. The result includes the sibling dylib, outside the analyzed root. ### Expected behavior Candidates stay inside the analyzed root on every host, as they do on macOS and Linux. A component that cannot name a file in the root is reported as `absent`. ### Impact and scope Windows hosts only. A traced bundle can make REA read and hash a file outside the directory the caller selected. ### REA version 6.7.0, revision `bcd18d289` ### Runtime and platform Windows 11, Node 24.22.1 ### Target and artifact context Synthetic Mach-O fixtures; no real application. ### Interface MCP ### Earliest failure stage Artifact or evidence registration ### Relevant output or evidence Root cause and fix are in #6955, with the regression tests. ### Typed outcome or recovery expected No new error. The candidate is `absent`. ### Analysis or suspected cause Root cause and fix are in #6955. ### Additional context Fixed by #6955.

bsakaguchi closed this issue

2026-10-31 00:48:04 +00:00

bsakaguchi referenced this issue

2026-10-31 01:12:18 +00:00

[PR #4283] [CLOSED] feat(mcp): add native vulnerability review prompt #6158

bsakaguchi referenced this issue

2026-11-01 21:10:57 +00:00

[GH-ISSUE #3796] [Tracker] Open feature requests by area (October 2026) #1471