Escape file paths and remote schedule command in shell invocations
fix(security): escape file paths and remote schedule command in shell invocations
Escape file paths and remote schedule command in shell invocations16b5b7-fix-escape-file-paths-and-remote-schedule-cve-2026-72880fixescape file paths remote schedule command
Committed by Siumauricio
commit message
fix(security): escape file paths and remote schedule command in shell invocations
quote() the user-derived paths that reach the shell in file mounts
(mount.ts, docker getCreateFileCommand), patch repo read (repoPath/filePath),
certificate create/remove (certificatePath), and the remote scheduled command
(containerId/shellType/command/logPath), so $(), backticks and traversal in
these fields can no longer inject commands.Editor assessment
This commit patches CVE-2026-93425. A compact but complete security message. The body maps each sink that reached the shell - file mounts, repo read, certificate create/remove, the remote scheduled command - and says every user-derived path is now quoted so $(), backticks and traversal cannot inject commands. That is concrete and verifiable. The header is clean; a scope would make it exemplary, but the subject already names the two affected behaviors clearly. Formally the message is clean - correct fix type, no scope, no trailing period, body separated - so the only optional improvement is adding a scope to an already strong security explanation.