---
# System prepended metadata

title: omnitool v0.4.0 RCE vulnerability

---

CVE-2025-50739 

iib0011 omni-tools v0.4.0 is vulnerable to remote code execution. The JSON Stringify tool unsafely uses the eval() function to parse user-provided text as a JavaScript object. A remote attacker can craft a malicious string or json file using a JavaScript comma operator to execute arbitrary code before the intended object evaluation. This allows for a full range of client-side attacks, including Cross-Site Scripting (XSS), session hijacking, and data exfiltration, when a user inputs or upload the malicious payload into the tool's text field.


POC

![螢幕截圖 2025-06-09 上午1.32.02](https://hackmd.io/_uploads/B1AMtr7mlg.png)

By inputing alert() in the textbox,![螢幕截圖 2025-06-09 上午1.32.39](https://hackmd.io/_uploads/SyQSFrm7le.png)

Also, attacker can upload a malicious json by 'import from file', which also trigger the script. The attacker could send the malicious json to victim and ask them to upload to this site to trigger the script.