model-office

No explicit malicious code is evident within this module (no eval/exec, subprocesses, or direct exfiltration). However, the design is security-sensitive: unauthenticated endpoints/WebSockets, wildcard CORS, unthrottled background execution driven by a user-provided task string, and replay/broadcast of untrusted event payloads to all connected clients. The primary risk therefore hinges on what dispatcher/worker do with that input; this module itself should be treated as a high-trust coordinator that materially increases the impact of any unsafe behavior in downstream code.

No clear evidence of classic malware (no system compromise, crypto-mining, or remote command execution) in this snippet. However, it contains a high-impact client-side vulnerability: DOM XSS. Untrusted WebSocket payload fields are interpolated into HTML strings and inserted via innerHTML in addLog(). The partial escaping applied to the job result preview (only replacing '<') is insufficient for safe HTML injection. Treat this module as security-critical: logs must use textContent (or robust sanitization/templating) and all untrusted values must be fully escaped/encoded for the intended HTML context.