Is there a way to execute a bash command when I click on a text in a browser?

The web page is on computer A, the browser is on computer B : I want to execute the code on computer B, e.g hsetroot to change the wallpaper when clicking an image.


5 Answers 5


Not really, no. That is the mother of all security holes. You are asking if you can set up a webpage that executes arbitrary commands on the client's machine. What if I set up a webpage that runs this command:

rm -rf ~/

That would delete all files in your $HOME. In fact, there was recently an uproar when a bug was discovered that allowed this to happen. One of the possible attack vectors was tricking the client (computer B in your case) into running a bash command.

So no, you can't execute arbitrary code on your local machine through a web browser. Not without somehow logging in first. You can run JavaScript or similar language commands but they won't have access to your user's session.

  • Thank for the answer, i understand the obvious issue there. I'm trying to achieve that with a custom browser : stackoverflow.com/questions/30963508/…
    – bob dylan
    Commented Jun 21, 2015 at 10:38
  • @bobdylan I don't think that's possible. I certainly hope it isn't anyway. That's a cool little program, by the way. I had no idea it was that simple to do! The point, however, is that I don't think it is possible to initiate a local shell session from the browser.
    – terdon
    Commented Jun 21, 2015 at 10:55
  • Well let's say i want to make an hybrid website / program with some functionality linked to my OS. So my browser won't be a normal "browser". So i don't see how it's not possible.
    – bob dylan
    Commented Jun 21, 2015 at 10:58
  • Certainly it’s possible for a program to do.  Consider: there’s no difference, in principle, between an FTP client and a browser (an HTTP client) — both interact with a local user and with a server.  Trivially, the FTP client can modify local files and execute (some) local commands.  Sure, it’s only at the request of the user, but that’s not a real constraint.  So a browser can do the same.  I heard, about ten years ago, that some of the major browsers had a security setting so low that they allowed this, but I don’t recall details, and things have probably been tightened up since then. Commented Jun 21, 2015 at 13:26
  • @G-Man I don't know if it's possible for a click to be passed back to the browser and cause a shell session to start. FTP is very different since that initiates a session by definition. I'm not saying it's 100% impossible, I don't really know, I just think it's impossible and it's certainly not possible with existing browsers.
    – terdon
    Commented Jun 21, 2015 at 13:32

I solve it using a nodeJS server. (not clean/final code but its working)

Computer A : (server)

function change_wallpaper(image){
    var objReq = new XMLHttpRequest();
    objReq.open("GET", "http://localhost:8888" + "?image=" + image, false);
<img src="./img/1.jpeg" onclick="change_wallpaper(this.src);" />
<img src="./img/2.jpeg" onclick="change_wallpaper(this.src);" />

Computer B : (client) file called server.js ans executed with nodejs server.js

var http = require("http");
var sys = require('sys')
var exec = require('child_process').exec;
var url = require("url");

function onRequest(request, response) {
    var params = url.parse(request.url,true).query;
    function puts(error, stdout, stderr) {sys.puts(stdout)}
    exec("/usr/bin/feh --bg-center " + params.image, puts);
    response.writeHead(200, {'Content-Type': 'text/plain'});

  • as my answer led you to the method to use, you asked for, it would have been nice to just ask for an edit for my answer, including your code and except it as I describe a method to execute a shell command, as you asked for and its a general approach. Writing portable services for client machines can do many, many things. If you would vote for my answer that would be ok too.
    – ikrabbe
    Commented Jun 25, 2015 at 6:10
  • 3
    @ikrabbe the OP can't vote, they don't have the rep. As for accepting, yes your answer (which I did upvote) did indeed give them a pointer but you didn't explain how they could use nodejs nor did you give an example. Your answer was very useful but it didn't really solve the OP's problem, it only pointed them in the right direction. Posting their own answer and accepting it is perfectly OK.
    – terdon
    Commented Jun 29, 2015 at 18:17

You cannot do that in general, but in a defined environment, where you can control the client machine B, you can propose that machine B runs a setroot service, you can simply write on your own with nodejs or golang for example and talk to that service when you receive the event. But in any case you don't have any chance (or at least you never should have a chance) if you don't install some extra service on machine B.

  • I've never used NodeJs before. You mean i can use a simple javascript like : run("whatever command on machine B"); ?
    – bob dylan
    Commented Jun 25, 2015 at 3:57
  • yes, nodejs is very simple to use for such reduced needs.
    – ikrabbe
    Commented Jun 25, 2015 at 6:11

PHP can change content of textfiles cross the browser for example in /var/www/.../folder/mytextfie.txt You have only to get the string from that file, whitch can be a command or even command to start a script file.

a cronjob can run to check wether that textfile contains any executable.

#!/usr/bin/env bash
echo $(cat /var/www/.../folder/commandsperline.txt)
while read line
    echo "$(${line})"
done< "/var/www/.../folder/commandsperline.txt"

context of that textfile:

#!/bin bash
#you need to declare absolute path
# chmod 755 /home/user/*.sh -to make executabble all scripts there

With te while loop it is possible to execute commands from that text-file.

  • 1
    but how does that answer the question, regarding a click event in a web page? Commented May 11, 2020 at 15:40

Yes.. it is possible with neutralinojs.

You can use Neutralino.os.runCommand(). But in your scenario Neutralino cloud mode can be used.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .