Skip to content

fix(security): remove shell: true from execa calls to prevent command injection - #449

Merged
Pedrovaleriolopez merged 1 commit into
SynkraAI:pedro-aiosfrom
riaworks:fix/shell-injection
Feb 21, 2026
Merged

fix(security): remove shell: true from execa calls to prevent command injection#449
Pedrovaleriolopez merged 1 commit into
SynkraAI:pedro-aiosfrom
riaworks:fix/shell-injection

Conversation

@riaworks

@riaworks riaworks commented Feb 21, 2026

Copy link
Copy Markdown
Contributor

Summary

  • sandbox-tester.js: Remove redundant shell: true from execa() in runCommand() — args were already split into array, making shell interpretation unnecessary and a security risk
  • subtask-verifier.js: Remove shell: true from execa() path and replace execSync fallback with execFileSync + proper argument splitting

Context

Both scripts already split command strings into program + args array before passing to execa(), making shell: true completely redundant. With shell: true, shell metacharacters (;, |, &&, $()) in command inputs would be interpreted, enabling potential command injection.

Risk Assessment

  • sandbox-tester.js was flagged as the most dangerous file in the codebase due to shell: true + arbitrary command execution
  • subtask-verifier.js combines shell execution + network access + browser automation — broad attack surface

Changes

File Change
sandbox-tester.js:454 Removed shell: true from execa() options
subtask-verifier.js:277 Replaced execSync with execFileSync + arg splitting
subtask-verifier.js:304 Removed shell: true from execa() options

Test plan

  • npm test passes
  • Sandbox tester runs npm test and npm run lint commands correctly without shell: true
  • Subtask verifier command verification works with execFileSync fallback

🤖 Generated with Claude Code

@riaworks @claude
fix(security): remove shell: true from execa calls to prevent command…
4c8a45c 
… injection

- sandbox-tester.js: remove redundant shell: true (args already split)
- subtask-verifier.js: remove shell: true from execa path
- subtask-verifier.js: replace execSync fallback with execFileSync + arg splitting
- Both scripts already split commands into program + args array, making
  shell interpretation unnecessary and a security risk (metacharacter injection)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@vercel

vercel Bot commented Feb 21, 2026

Copy link
Copy Markdown

@riaworks is attempting to deploy a commit to the Pedro Valério Lopez's projects Team on Vercel.

A member of the Team first needs to authorize it.

@coderabbitai

coderabbitai Bot commented Feb 21, 2026 •
edited
Loading

Copy link
Copy Markdown

Note

Reviews paused

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)
  • main

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment

Tip

Issue Planner is now in beta. Read the docs and try it out! Share your feedback on Discord.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@riaworks riaworks mentioned this pull request Feb 21, 2026
Open
@riaworks

riaworks commented Feb 21, 2026

Copy link
Copy Markdown
Contributor Author

CodeRabbit review is running on the fork PR: riaworks#2
Review results will be validated there before requesting merge here.

@coderabbitai ignore

@coderabbitai

coderabbitai Bot commented Feb 21, 2026

Copy link
Copy Markdown

@riaworks: Understood! I'll pause reviews on this PR while you validate the changes on the fork PR. Feel free to ask me to resume when you're ready to merge.

✅ Actions performed

Reviews paused.

@Pedrovaleriolopez
Pedrovaleriolopez merged commit 589a317 into SynkraAI:pedro-aios Feb 21, 2026
2 of 4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@riaworks @Pedrovaleriolopez