V: os.cp is exploitable

[arg2das]

It just uses os.system("cp loc dest");

So, if you use os.cp(". ; <command>", "." ) you could execute any code.

[medvednikov]

Yes, it's a temporary solution until a real os.cp is implemented for non-Windows systems.

I've just banned ; and && in exec/system, so this particular exploit won't work anymore.

[radare]

on iOS/macOS there's a syscall to do this

if $darwin {
  copyfile(...)
}

[medvednikov]

Fixed.