Mojira Archive
MC-137689

Commands can store arbitrary text into the Command tag

The bug

Commands are able to store text in the Command tag of a command block or command block minecart. If a datapack or command block structure is set up to allow modifying or setting that tag in some way, this can lead to non opped players running arbitrary commands.

How to reproduce

  1. Take a book and quill, write a command in it and hold it
  2. Place a command block below you
    /setblock ~ ~-1 ~ command_block
    
  3. Run the following command
    /data modify block ~ ~-1 ~ Command set from entity @s SelectedItem.tag.pages[0]
    

    Notice that the command in the command block has been set to the text in the book