nanoDLP unauthenticated G-code injection RCE

Guest POST /formula evaluates JavaScript with nanodlpContext; ShieldUnpause is persisted via Config.Save, then GET /printer/unpause executes Exec cmd as root. !/usr/bin/env python3 -- coding: utf-8 -- """nanoDLP unauthenticated G-code injection RCE via /formula and /printer/unpause.""" from futur...