[SECURITY] CRITICAL: Telegram bot token visible in process command line #4

New Issue

shoko · 2026-03-25T10:37:24+01:00

shoko commented

2026-03-25 10:37:24 +01:00

Severity: CRITICAL

Users should stop using the --telegram flag on shared systems until this is fixed.

Description

The Telegram bot token is passed as a subprocess argument to curl, making it visible in the process command line via ps aux or /proc/*/cmdline. Any user on a shared system can view all running processes command lines.

Location

scripts/browse.py lines 598-606 (send_to_telegram())

Proof of Concept

ps aux | grep curl
# Output:
# curl -s https://api.telegram.org/bot123456789:TOKEN/sendMessage -d chat_id=... -d text=...

Impact

Any local user can steal the bot token
Attacker can send arbitrary messages from the bot
Use the bot for spam, phishing, or social engineering

Recommended Fix

Use Python requests library instead of curl subprocess:

import requests

def send_to_telegram(...):
    bot_token = os.environ.get("BOT_TOKEN")
    chat_id = os.environ.get("CHAT_ID")
    url = f"https://api.telegram.org/bot{bot_token}/sendMessage"
    payload = {"chat_id": chat_id, "text": text, "parse_mode": "HTML"}
    resp = requests.post(url, data=payload, timeout=10)

Immediate Action

Rotate your bot token via @BotFather /revoke
Do not use --telegram on shared systems

Reference

See reviews/2026-03-25.md Section 6.2

## Severity: CRITICAL **Users should stop using the `--telegram` flag on shared systems until this is fixed.** ## Description The Telegram bot token is passed as a subprocess argument to `curl`, making it visible in the process command line via `ps aux` or `/proc/*/cmdline`. Any user on a shared system can view all running processes command lines. ## Location `scripts/browse.py` lines 598-606 (`send_to_telegram()`) ## Proof of Concept ```bash ps aux | grep curl # Output: # curl -s https://api.telegram.org/bot123456789:TOKEN/sendMessage -d chat_id=... -d text=... ``` ## Impact - Any local user can steal the bot token - Attacker can send arbitrary messages from the bot - Use the bot for spam, phishing, or social engineering ## Recommended Fix Use Python `requests` library instead of curl subprocess: ```python import requests def send_to_telegram(...): bot_token = os.environ.get("BOT_TOKEN") chat_id = os.environ.get("CHAT_ID") url = f"https://api.telegram.org/bot{bot_token}/sendMessage" payload = {"chat_id": chat_id, "text": text, "parse_mode": "HTML"} resp = requests.post(url, data=payload, timeout=10) ``` ## Immediate Action 1. Rotate your bot token via @BotFather `/revoke` 2. Do not use `--telegram` on shared systems ## Reference See `reviews/2026-03-25.md` Section 6.2

shoko added the security label 2026-03-25 10:37:45 +01:00

shoko added the critical label 2026-03-25 10:40:33 +01:00

shoko referenced this issue

2026-03-25 10:40:34 +01:00

[SECURITY] polymarket-browse: Security Audit Tracking (2026-03-25) #3

shoko referenced this issue from a commit

2026-03-25 11:46:19 +01:00

Fix CRITICAL: Telegram bot token exposed in process command line

shoko closed this issue

2026-03-25 11:46:19 +01:00

shoko referenced this issue from a commit

2026-03-25 12:07:18 +01:00