This page collects WhisperX intelligence signals tagged #shell-injection. It is designed for humans, search engines, and AI agents: each item links to a canonical source-backed record with sector, source, timestamp, credibility, and exportable structured data.
A critical shell injection vulnerability has been identified in the `bin/aios.js` script, exposing systems to potential remote code execution (RCE). The flaw resides on line 15, where the `execSync` function uses a template string to construct a PowerShell command. This construction method allows an attacker to inject ...
A shell injection vulnerability has been identified in the installer for the Statusline project, where unsanitized user input could allow for arbitrary code execution. The flaw is located in the `install.sh` script, specifically lines 142-162, where user-controlled input from the `variant_choice` variable flows directl...
A critical shell injection vulnerability has been identified in two core components of the codebase, exposing systems to potential arbitrary command execution. The flaw resides in the use of `asyncio.create_subprocess_shell()` with unsafe string interpolation, allowing user-controlled input to be interpreted as shell c...
A high-severity security vulnerability has been flagged in the project's release automation code. The automated security scanner `bandit` identified a `B605` rule violation—'Start Process With A Shell'—on line 281 of the `RELEASING/changelog.py` file. This class of vulnerability, categorized under CWE-78 (Improper Neut...
A high-severity security vulnerability has been flagged in a key automation script, exposing the codebase to potential shell injection attacks. The scanner identified a `subprocess.Popen` call configured with `shell=True` in the file `scripts/cypress_run.py` at line 83. This configuration is a known security anti-patte...
A critical security regression has been identified in the staging environment at commit 36240c75, involving the deleteViaEphemeral function. The vulnerability, catalogued as F1502 under CWE-78 (OS Command Injection), stems from shell string concatenation in the deletion logic. The affected code constructs the command a...
A security audit has flagged a fragile interpolation pattern in the hook installation mechanism of the CLI package that, if left unaddressed, could enable shell injection. The file `packages/cli/src/commands/install-hooks.ts` writes a generated shell script where the `fallbackCmd` variable is substituted directly into ...
Security researchers have identified a shell-injection vulnerability pathway in the terminal command template used across the codebase. The issue centers on a shell-script string built for `pty.spawn` that directly interpolates user-controlled values — including worktree paths, branch names, and agent prompts — without...
A high-severity shell injection vulnerability has been identified in the Unix implementation of `GitOperations::exec` within `src/git/operations.cpp`. The method constructs shell commands using `popen` with string-interpolated arguments, directly incorporating user-supplied parameters such as branch names and commit me...