Observed Signal · Sep 6, 2026 · Technical Release · Source: DEV Community · Impact: 2/5 · Sentiment: Neutral
Sonar DNS Field Command Injection Fixed by Developer
A developer discovered a command injection vulnerability in the DNS custom resolver field of Sonar, a macOS network scanning tool. The field, which accepts user input for custom DNS servers like Pi-hole or NextDNS, was passed to a privileged command without proper validation, potentially allowing arbitrary code execution as root. The fix involved allowlisting input to only accept valid IP addresses, passing arguments as an array instead of a shell string, and narrowing the privileged interface. The article also details three other security fixes made during a full pass: moving API tokens from a plist to the Keychain, preventing CSV export formula injection, and implementing atomic writes to avoid data corruption.
This is a security fix in a niche macOS app, relevant to the AdTech industry only as a general security best practice example, not a major platform event.
Track Sonar Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your Polaris7 workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- Sonar had a command injection vulnerability in its DNS resolver field.
- The vulnerability could allow running commands as root.
- The fix involves allowlisting IP addresses and using array arguments.
- API tokens were moved from preferences to Keychain.
- CSV export now prevents formula injection.
- Atomic writes prevent data loss from crashes.
Connected Companies & Entities
3 Entities mapped“Sonar has a Control tab. One of the things it does is switch the DNS resolver for your Mac.”
“tap Cloudflare, tap Quad9, or paste in the address of your own Pi-hole.”
“The custom-resolver field exists because people run Pi-hole and NextDNS on their own networks.”
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
SSRF Risk Exposed by CVE-2024-29415 in npm ip
This developer post explains Server-Side Request Forgery (SSRF), demonstrates how SSRF can expose cloud metadata and credentials, and documents CVE-2024-29415 — a May 2024 vulnerability in the npm ip package where isPublic() misclassified non-standard IP representations (e.g., 127.1, octal/hex forms) as public. The article provides a catalogue of adversarial SSRF payloads, example test suites (pytest, Playwright, Robot Framework, TypeScript), CI gating recommendations, and prevention guidance: use allowlists of permitted destinations, perform post-resolution IP validation with hardened libraries, and apply network-level defenses (e.g., IMDSv2, security groups). The piece is published on DEV Community as part of a QA-focused series and includes practical test code to catch SSRF bypasses in CI/CD.
Ghostjacking: Logs Turned into Commands for AI Agents
Security researchers published a proof-of-concept called "ghostjacking" showing how attackers can embed natural-language commands into logs, alerts, and issue trackers so AI agents with read and write permissions will execute those commands. The PoC chains target systems like Cloudflare WAF logs, Datadog alerts, and Sentry reports to cause DNS changes, execute shell commands, steal cloud credentials, propagate commands to other agents, and persist backdoors in agent memory or configs. Tests used researcher-controlled accounts and public APIs; no CVE has been published and Claude Desktop’s sandbox bypass was reported to Anthropic and patched. The report outlines success/failure conditions, detection signals, MITRE mappings, and an investigation/containment playbook for SOCs and administrators.
Two-Line NPM Supply-Chain Attack via Rogue Registry
A developer details a small but dangerous supply-chain attack submitted as a pull request to their repository. The PR added a .npmrc that silently redirects all package resolution to an attacker-controlled IP over plain HTTP and inserted a new dependency in package.json that would be resolved from the hostile registry. The malicious change relied on trivial-looking diffs to bypass cursory review; a human reviewer stopped the merge after spotting the IP-based, non-HTTPS registry entry. The author explains the exploit mechanics, demonstrates why such minimal changes are effective, and recommends mitigations: treat .npmrc as security-critical, add CI checks to reject non-HTTPS or IP-based registries, pin/verify dependencies and lockfiles, restrict egress from build environments, and prefer reviewing diffs over PR descriptions.
Receive all future signals for Sonar & competitors in your briefing
Never miss material M&A deals, leadership changes, account wins, or product rollouts. Polaris7 monitors 20,000+ primary sources 24/7, delivering verified telemetry directly into your executive briefing.