doc: add alert on REPL from TCP socket

PR-URL: #54594 Refs: https://hackerone.com/reports/2684357 Reviewed-By: Matteo Collina <[email protected]> Reviewed-By: Marco Ippolito <[email protected]>
nodejs · Aug 30, 2024 · 9f817a5 · 9f817a5
1 parent 1f2cc2f
commit 9f817a5
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/doc/api/repl.md b/doc/api/repl.md
@@ -774,6 +774,14 @@ a `net.Server` and `net.Socket` instance, see:
 For an example of running a REPL instance over [`curl(1)`][], see:
 <https://gist.github.com/TooTallNate/2053342>.
 
+This example is intended purely for educational purposes to demonstrate how
+Node.js REPLs can be started using different I/O streams.
+It should **not** be used in production environments or any context where security
+is a concern without additional protective measures.
+If you need to implement REPLs in a real-world application, consider alternative
+approaches that mitigate these risks, such as using secure input mechanisms and
+avoiding open network interfaces.
+
 [TTY keybindings]: readline.md#tty-keybindings
 [ZSH]: https://en.wikipedia.org/wiki/Z_shell
 [`'uncaughtException'`]: process.md#event-uncaughtexception