Keybase advisory: Local Privilege Escalation on Linux via Keybase-Redirector

They probably weren't even aware that they were doing an exec.Command, as they say they were using a go dependency for the mount behavior. Whoever wrote your dependency might not have had your use case in mind when writing the library. When you evaluate your dependencies you have take into account what differences there are between the authors usecase, and yours.

It would be easy to say that dependencies are a bad thing, especially when writing programs that are run as root or even suid, but there's no reason to assume the same mistake would not have been made if they wrote the mounting code themselves.

The big lesson should be that there should always be an explicit step to your software development process that is to evaluate the security characteristics of your program. Of course, it should always also be on your mind while writing code, but there's so many layers you depend on, and so many things you might not think of.

The advantage is it means arbitrary programs can then interact with the Keybase filesystem, as opposed to having to manually copy the files you want to/from it.

Also worth noting this was fixed in September.