mirror of
https://github.com/OpenRouterTeam/spawn.git
synced 2026-05-11 21:40:48 +00:00
63bce1bd04
All 6 cloud providers interpolated process.env.TERM directly into shell commands without validation. A malicious TERM value (e.g., containing $(cmd)) would execute on the remote server, potentially exfiltrating OPENROUTER_API_KEY and other credentials. Add sanitizeTermValue() allowlist (alphanumeric, dots, hyphens, underscores) to cli/src/shared/ui.ts and apply it in all interactiveSession functions. Agent: security-auditor Co-authored-by: B <6723574+louisgv@users.noreply.github.com> Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| agents.ts | ||
| fly.ts | ||
| main.ts | ||