open/llm-security
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity Actions

chore(llm-security): v7.8.1 — security patch release

Browse source 
Version bump + release notes for the auto-cleaner command-injection fix
(f083cda). Security patch only; no feature changes. 1865 tests, 0 fail.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TcQyMTQfyrsAapaCMPxTtQ
This commit is contained in:
Kjell Tore Guttormsen 2026-07-18 09:00:18 +02:00
commit 55d01d1656
6 changed files with 65 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

26
docs/version-history.md
View file

@ -2,6 +2,32 @@
Per-release notes for v7.0.0 onward. Imported from `CLAUDE.md` via `@docs/version-history.md`.
## v7.8.1 — Auto-cleaner command-injection fix (CRITICAL)
Security patch for a CRITICAL defect introduced with the v7.8.0 auto-cleaner
hardening pass. No feature changes; full suite green at 1865/0.
`scanners/auto-cleaner.mjs` validated candidate `.mjs`/`.js`/`.cjs` content by
shelling out to ``node --check "${tmpPath}"`` via `execSync`. `tmpPath` is
derived from the finding's `file` field — an untrusted scanned-repo filename.
The F-2 containment guard that landed in v7.8.0 verifies the resolved path
stays inside the scanned tree, but performs no shell-metacharacter handling, so
a filename whose `"` terminates the interpolated quote injects a second
command. Because `/security clean` runs in live mode by default, scanning a
hostile repository was sufficient to execute attacker-chosen commands locally.
The defect was reproduced with a live proof-of-concept before being fixed.
Both subprocess sites now use `spawnSync` with an argv array — the syntax check
and the CLI's inline scan-orchestrator fallback — so no shell interprets a path.
As defense-in-depth, `applyFixes()` additionally refuses any finding whose
`file` carries shell or control metacharacters, surfacing it as `skipped`.
Regression coverage is deliberately split across both layers
(`tests/scanners/auto-cleaner-rce.test.mjs`): one test drives `validateContent`
directly to prove the shell is gone, because the metacharacter guard would
otherwise stop the hostile input before it reached the sink and the test would
pass without testing the fix.
## v7.8.0 — Trigger, signature, and AST-taint scanners
Three new deterministic deep-scan scanners (TRG/SIG/AST), each with its own