# Risk map — 2dust/v2rayN

> Canonical page: https://codevetter.com/unpack/v2rayn/risk-map

# Risk map — 2dust/v2rayN

Scanned commit 28139853a8087d81e1ac7ffaf7013b937958f5d2 (2026-09-20). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

The biggest risk surface is OS-level mutation: registry/WinInet proxy changes, autostart registration, sudo shell scripts carrying a GUI-entered sudo password, and a self-updater that extracts a network-downloaded zip over the install directory. SQL built by string interpolation in ProfileModels is only partially sanitized. The GlobalHotKeys submodule and ServiceLib.UdpTest project reference are easy build breakers. Heavy catch-all swallowing and a 3000-line ConfigHandler concentrate blast radius, and the ProfileItem ConfigVersion migration chain is delicate and untested.
- Linux/macOS TUN mode stores the user's sudo password in memory (AppManager.LinuxSudoPwd) and pipes it into 'sudo -S' via generated run_as_sudo.sh / kill_as_sudo.sh scripts under binConfigs — a plaintext credential-in-shell path that also leaves a world-visible generated script. — [v2rayN/ServiceLib/Manager/AppManager.cs#L33](https://github.com/2dust/v2rayN/blob/28139853a8087d81e1ac7ffaf7013b937958f5d2/v2rayN/ServiceLib/Manager/AppManager.cs#L33) [v2rayN/ServiceLib/Manager/CoreAdminManager.cs#L32-104](https://github.com/2dust/v2rayN/blob/28139853a8087d81e1ac7ffaf7013b937958f5d2/v2rayN/ServiceLib/Manager/CoreAdminManager.cs#L32-L104)
- AppManager.ProfileModels builds raw SQL with interpolated subid and a user-supplied filter; the only sanitization is stripping single quotes from filter, so other injection-adjacent characters pass through into SQLite QueryAsync. — [v2rayN/ServiceLib/Manager/AppManager.cs#L202-230](https://github.com/2dust/v2rayN/blob/28139853a8087d81e1ac7ffaf7013b937958f5d2/v2rayN/ServiceLib/Manager/AppManager.cs#L202-L230)
- Self-update downloads a zip from GitHub over (optionally proxied) HTTPS and AmazTool extracts it over the install dir with only a 'bin/' skip rule — no in-app signature/hash verification is performed on the archive (GPG verification is offered manually per README). — [v2rayN/AmazTool/UpgradeApp.cs#L41-107](https://github.com/2dust/v2rayN/blob/28139853a8087d81e1ac7ffaf7013b937958f5d2/v2rayN/AmazTool/UpgradeApp.cs#L41-L107) [v2rayN/ServiceLib/Services/UpdateService.cs#L9-47](https://github.com/2dust/v2rayN/blob/28139853a8087d81e1ac7ffaf7013b937958f5d2/v2rayN/ServiceLib/Services/UpdateService.cs#L9-L47) [README.md#L57-68](https://github.com/2dust/v2rayN/blob/28139853a8087d81e1ac7ffaf7013b937958f5d2/README.md#L57-L68)
- AmazTool.Upgrade kills every process named 'v2rayN' whose MainModule path starts with the app dir, then extracts entries by stripping the first path segment — a maliciously crafted zip entry name could still resolve outside intended paths (no explicit traversal check on entry.FullName). (inferred) — [v2rayN/AmazTool/UpgradeApp.cs#L21-90](https://github.com/2dust/v2rayN/blob/28139853a8087d81e1ac7ffaf7013b937958f5d2/v2rayN/AmazTool/UpgradeApp.cs#L21-L90)
- ProxySettingWindows uses raw WinInet P/Invoke with manually allocated marshaled buffers (five 'remember to deallocate' sites); the code frees them but any early-return/exception path between alloc and free leaks unmanaged memory, and failure falls back to direct registry writes under 'HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings'. — [v2rayN/ServiceLib/Handler/SysProxy/ProxySettingWindows.cs#L8-34](https://github.com/2dust/v2rayN/blob/28139853a8087d81e1ac7ffaf7013b937958f5d2/v2rayN/ServiceLib/Handler/SysProxy/ProxySettingWindows.cs#L8-L34) [v2rayN/ServiceLib/Handler/SysProxy/ProxySettingWindows.cs#L79-198](https://github.com/2dust/v2rayN/blob/28139853a8087d81e1ac7ffaf7013b937958f5d2/v2rayN/ServiceLib/Handler/SysProxy/ProxySettingWindows.cs#L79-L198)
- Custom server configs read arbitrary file paths: node.Address is used directly as a filesystem path (GenerateClientCustomConfig copies it; RegisterSingleNodeAsync reads it into CustomOutboundContent) — a crafted profile could point at any readable file. — [v2rayN/ServiceLib/Handler/CoreConfigHandler.cs#L44-91](https://github.com/2dust/v2rayN/blob/28139853a8087d81e1ac7ffaf7013b937958f5d2/v2rayN/ServiceLib/Handler/CoreConfigHandler.cs#L44-L91) [v2rayN/ServiceLib/Handler/Builder/CoreConfigContextBuilder.cs#L343-363](https://github.com/2dust/v2rayN/blob/28139853a8087d81e1ac7ffaf7013b937958f5d2/v2rayN/ServiceLib/Handler/Builder/CoreConfigContextBuilder.cs#L343-L363)
- PacManager.RunListener creates a TcpListener on the PAC port and answers every connection with the PAC bytes without request parsing or binding check — the listener inherits default binding behavior and any local (or LAN, if bound broadly) client can fetch the PAC file. — [v2rayN/ServiceLib/Manager/PacManager.cs#L60-93](https://github.com/2dust/v2rayN/blob/28139853a8087d81e1ac7ffaf7013b937958f5d2/v2rayN/ServiceLib/Manager/PacManager.cs#L60-L93)
- The ProfileItem schema migration chain (ConfigVersion <3 -> MigrateProfileExtraV2ToV3 rewriting per-protocol fields into ProtocolExtra JSON; =3 -> MigrateProfileTransportV3ToV4 reshaping transport fields) runs synchronously-blocked at startup and has no test coverage — a bad batch permanently corrupts stored profiles. — [v2rayN/ServiceLib/Manager/AppManager.cs#L107-113](https://github.com/2dust/v2rayN/blob/28139853a8087d81e1ac7ffaf7013b937958f5d2/v2rayN/ServiceLib/Manager/AppManager.cs#L107-L113) [v2rayN/ServiceLib/Manager/AppManager.cs#L328-475](https://github.com/2dust/v2rayN/blob/28139853a8087d81e1ac7ffaf7013b937958f5d2/v2rayN/ServiceLib/Manager/AppManager.cs#L328-L475)
- ConfigHandler.cs is ~3000 lines containing config load/save, profile CRUD, batch import of five formats, sub/group management, routing/DNS/template init and regional presets — a single static god-class where a mistake in one feature can break unrelated persistence. — [v2rayN/ServiceLib/Handler/ConfigHandler.cs](https://github.com/2dust/v2rayN/blob/28139853a8087d81e1ac7ffaf7013b937958f5d2/v2rayN/ServiceLib/Handler/ConfigHandler.cs)
- v2rayN/GlobalHotKeys is a git submodule that is empty in a non-recursive clone; v2rayN.Desktop.csproj references GlobalHotKeys/src/GlobalHotKeys/GlobalHotKeys.csproj so the Desktop build fails outright without 'submodules: recursive' (which the workflows do set). — [.gitmodules](https://github.com/2dust/v2rayN/blob/28139853a8087d81e1ac7ffaf7013b937958f5d2/.gitmodules) [v2rayN/v2rayN.Desktop/v2rayN.Desktop.csproj#L40](https://github.com/2dust/v2rayN/blob/28139853a8087d81e1ac7ffaf7013b937958f5d2/v2rayN/v2rayN.Desktop/v2rayN.Desktop.csproj#L40) [.github/workflows/build.yml](https://github.com/2dust/v2rayN/blob/28139853a8087d81e1ac7ffaf7013b937958f5d2/.github/workflows/build.yml)
- Exceptions are swallowed broadly: AppExitAsync wraps the whole shutdown in catch{}, ProcessService.StopAsync/Dispose have nested empty catches, SysProxyHandler.UpdateSysProxy catches and returns true on failure — masking cleanup failures that leave cores running or the system proxy stuck. — [v2rayN/ServiceLib/Manager/AppManager.cs#L122-148](https://github.com/2dust/v2rayN/blob/28139853a8087d81e1ac7ffaf7013b937958f5d2/v2rayN/ServiceLib/Manager/AppManager.cs#L122-L148) [v2rayN/ServiceLib/Services/ProcessService.cs#L73-117](https://github.com/2dust/v2rayN/blob/28139853a8087d81e1ac7ffaf7013b937958f5d2/v2rayN/ServiceLib/Services/ProcessService.cs#L73-L117) [v2rayN/ServiceLib/Handler/SysProxy/SysProxyHandler.cs#L62-66](https://github.com/2dust/v2rayN/blob/28139853a8087d81e1ac7ffaf7013b937958f5d2/v2rayN/ServiceLib/Handler/SysProxy/SysProxyHandler.cs#L62-L66)
- Subscription download supports http:// URLs and an optional third-party subconvert proxy chain; subscription content is base64-decoded and imported wholesale into the profile DB — a hostile/compromised subscription can inject arbitrary outbound definitions or Custom nodes pointing to local files. (inferred) — [v2rayN/ServiceLib/Handler/SubscriptionHandler.cs#L75-195](https://github.com/2dust/v2rayN/blob/28139853a8087d81e1ac7ffaf7013b937958f5d2/v2rayN/ServiceLib/Handler/SubscriptionHandler.cs#L75-L195) [v2rayN/ServiceLib/Handler/ConfigHandler.cs#L2037-2135](https://github.com/2dust/v2rayN/blob/28139853a8087d81e1ac7ffaf7013b937958f5d2/v2rayN/ServiceLib/Handler/ConfigHandler.cs#L2037-L2135)
- WPF OnExit force-kills the current process (Process.GetCurrentProcess().Kill()) after logging — any async persistence still in flight at that point is truncated. — [v2rayN/v2rayN/App.xaml.cs#L82-87](https://github.com/2dust/v2rayN/blob/28139853a8087d81e1ac7ffaf7013b937958f5d2/v2rayN/v2rayN/App.xaml.cs#L82-L87)
- Timeouts for outbound fetches are asymmetric and short (DirectFetch 10s, ProxyFetch 30s, LocalFetch 5s); silent empty-string failures propagate as 'IsNullOrEmpty -> return null' so download errors frequently surface only as a generic failure message. (inferred) — [v2rayN/ServiceLib/Global.cs#L100-104](https://github.com/2dust/v2rayN/blob/28139853a8087d81e1ac7ffaf7013b937958f5d2/v2rayN/ServiceLib/Global.cs#L100-L104) [v2rayN/ServiceLib/Services/DownloadService.cs#L195-251](https://github.com/2dust/v2rayN/blob/28139853a8087d81e1ac7ffaf7013b937958f5d2/v2rayN/ServiceLib/Services/DownloadService.cs#L195-L251)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)