# Security fix brief — 3 shell/path injection sinks (2026-06-20)

> **Action brief for the NEXT session.** Found in the marketplace-wide review (full context:
> `docs/review-2026-06-20.md`). Do this **after the current active session finishes** — do not
> interleave with in-flight work.
>
> **Disclosure hold:** the review report (`review-2026-06-20.md`, commit `738770e`) and this brief
> are committed locally but **NOT pushed**, because F-1 is a working RCE with a reproduction
> payload. **Push both only together with the F-1 fix** — never publish the RCE detail to a public
> remote while it is still exploitable.

## Priority order

| # | Severity | Fix first? |
|---|----------|-----------|
| F-1 | **CRITICAL** (zero-interaction RCE) | **YES — before any `/security scan` of an untrusted repo URL** |
| F-2 | HIGH (arbitrary file write) | yes |
| F-3 | HIGH (command injection, pre-confirmation) | yes |
| F-4 | LOW | optional |
| F-5/F-6 | LOW (hygiene) | optional |

## Common root cause

F-1/F-2/F-3 all trust untrusted strings at a subprocess/filesystem sink. The fix family is the same:
**`execSync(shell-string)` → `spawnSync('cmd', [...argArray])`** (no shell), or input containment.
Every affected call site already has discrete tokens, so the change is mechanical and localized.

## F-1 — CRITICAL — `scanners/git-forensics.mjs`

- **Sink:** `git()` at `:59-66` runs `execSync(\`git ${cmd}\`)` (shell string). Attacker-controlled
  filenames from the scanned repo (`git ls-files` :202, `git log --name-only` :549) are interpolated
  at **:211, :223, :231, :564**. `"${relFile}"` quoting at :211 does NOT stop `$(...)`/backticks;
  :223/:231 are unquoted.
- **Why critical:** `gitScan` is in the **default** SCANNERS array (`scan-orchestrator.mjs:119`), and
  `commands/scan.md` clones a user-supplied GitHub URL then scans it. A hostile repo containing a
  file named `commands/$(touch INJECTED).md` runs arbitrary code on the analyst's machine on
  `/security scan <url>` — no install, no confirmation. Forensics runs **outside** the git-clone
  OS-sandbox (that wraps only the clone), so it runs unsandboxed on all platforms. Reproduced
  end-to-end.
- **Fix:** convert `git()` to `spawnSync('git', [...argArray], {cwd})` and pass each call site's
  tokens as an array (they are already discrete). No shell, no interpolation.
- **Verify:** add a test fixture repo with a file named `$(touch /tmp/pwned).md`; assert the scan
  completes and `/tmp/pwned` is NOT created. (TDD: write the failing repro first.)

## F-2 — HIGH — `scanners/auto-cleaner.mjs`

- **Sink:** `:776` `resolve(targetPath, f.file)` with no containment check; written at `:878-881`.
  `f.file` comes from findings JSON (untrusted repo filenames, or a fully attacker-chosen
  `--findings` file), so `file: "../../../.claude/settings.json"` writes outside the scanned tree.
- **Fix:** before writing, assert `absPath === targetPath || absPath.startsWith(targetPath + sep)`;
  otherwise skip + report.
- **Verify:** a finding with `file: "../escape.txt"` must be refused, not written.

## F-3 — HIGH — `hooks/scripts/pre-install-supply-chain.mjs` → `supply-chain-data.mjs`

- **Sink:** `pre-install-supply-chain.mjs:254` → `inspectNpmPackage` calls
  `execSafe(\`npm view ${spec} --json\`)`; `execSafe` (`supply-chain-data.mjs:221-227`) is
  `execSync` (shell). A spec like `foo;touch /tmp/X` survives `extractNpmPackages`+`parseSpec`
  (name=`foo;touch`) and reaches the shell. It fires on **PreToolUse(Bash) before** the user's npm
  install — so it executes pre-confirmation even if the user then denies the Bash call.
- **Fix:** `spawnSync('npm', ['view', spec, '--json'])`, or validate `spec` against
  `^[@/A-Za-z0-9._-]+$` before use. (pip/go/OSV paths already use fetch/array args — only the npm
  `npm view` path shells out.)
- **Verify:** a package spec `foo;touch /tmp/X` must not execute the `touch`.

## F-4 / F-5 / F-6 — LOW

- **F-4** `mcp-live-inspect.mjs:296` spawns the scanned target's declared MCP command (array-arg, no
  metachar injection). By-design for `/security mcp-inspect`, but scanning an untrusted target
  launches attacker-declared processes — add a confirm before spawning servers from a non-home target.
- **F-5/F-6** two stray committed root artifacts: `--json` (0-byte redirect husk) and `.orphaned_at`.
  Inert; `git rm` them.

## Closing gates (when fixing)

- TDD per fix (repro → red → green). Full `node --test` suite green.
- gitleaks clean. Re-run the F-1 repro to confirm the sink is closed.
- **Then** push: the F-1 fix commit + `review-2026-06-20.md` + this brief, together. After that the
  disclosure hold is lifted.
- Fixing F-1/F-2/F-3 lifts the plugin from B− to a solid A−.