PT-2026-20986

Summary: Remote Code Execution Unsafe handling of request parameters in the RPC HTTP server results in command injection Details In lib/bitcoin/rpc/http server.rb line 30-39, the JSON body of a POST request is parsed into command and args variables. These values are then passed to send, which is...