llm-security/docs/security-fix-brief-2026-06-20.md

Security fix brief — 3 shell/path injection sinks (2026-06-20)

Action brief for the NEXT session. Found in the marketplace-wide review (full context: docs/review-2026-06-20.md). Do this after the current active session finishes — do not interleave with in-flight work.

Disclosure hold: the review report (review-2026-06-20.md, commit 738770e) and this brief are committed locally but NOT pushed, because F-1 is a working RCE with a reproduction payload. Push both only together with the F-1 fix — never publish the RCE detail to a public remote while it is still exploitable.

Priority order

#	Severity	Fix first?
F-1	CRITICAL (zero-interaction RCE)	YES — before any /security scan of an untrusted repo URL
F-2	HIGH (arbitrary file write)	yes
F-3	HIGH (command injection, pre-confirmation)	yes
F-4	LOW	optional
F-5/F-6	LOW (hygiene)	optional

Common root cause

F-1/F-2/F-3 all trust untrusted strings at a subprocess/filesystem sink. The fix family is the same: execSync(shell-string) → spawnSync('cmd', [...argArray]) (no shell), or input containment. Every affected call site already has discrete tokens, so the change is mechanical and localized.

F-1 — CRITICAL — scanners/git-forensics.mjs

• Sink: git() at :59-66 runs execSync(\git ${cmd}`) (shell string). Attacker-controlled filenames from the scanned repo (git ls-files:202,git log --name-only:549) are interpolated at **:211, :223, :231, :564**."${relFile}"quoting at :211 does NOT stop$(...)`/backticks; :223/:231 are unquoted.
• Why critical: gitScan is in the default SCANNERS array (scan-orchestrator.mjs:119), and commands/scan.md clones a user-supplied GitHub URL then scans it. A hostile repo containing a file named commands/$(touch INJECTED).md runs arbitrary code on the analyst's machine on /security scan <url> — no install, no confirmation. Forensics runs outside the git-clone OS-sandbox (that wraps only the clone), so it runs unsandboxed on all platforms. Reproduced end-to-end.
• Fix: convert git() to spawnSync('git', [...argArray], {cwd}) and pass each call site's tokens as an array (they are already discrete). No shell, no interpolation.
• Verify: add a test fixture repo with a file named $(touch /tmp/pwned).md; assert the scan completes and /tmp/pwned is NOT created. (TDD: write the failing repro first.)

F-2 — HIGH — scanners/auto-cleaner.mjs

• Sink: :776 resolve(targetPath, f.file) with no containment check; written at :878-881. f.file comes from findings JSON (untrusted repo filenames, or a fully attacker-chosen --findings file), so file: "../../../.claude/settings.json" writes outside the scanned tree.
• Fix: before writing, assert absPath === targetPath || absPath.startsWith(targetPath + sep); otherwise skip + report.
• Verify: a finding with file: "../escape.txt" must be refused, not written.

F-3 — HIGH — hooks/scripts/pre-install-supply-chain.mjs → supply-chain-data.mjs

• Sink: pre-install-supply-chain.mjs:254 → inspectNpmPackage calls execSafe(\npm view ${spec} --json`); execSafe (supply-chain-data.mjs:221-227) is execSync(shell). A spec likefoo;touch /tmp/XsurvivesextractNpmPackages+parseSpec (name=foo;touch`) and reaches the shell. It fires on PreToolUse(Bash) before the user's npm install — so it executes pre-confirmation even if the user then denies the Bash call.
• Fix: spawnSync('npm', ['view', spec, '--json']), or validate spec against ^[@/A-Za-z0-9._-]+$ before use. (pip/go/OSV paths already use fetch/array args — only the npm npm view path shells out.)
• Verify: a package spec foo;touch /tmp/X must not execute the touch.

F-4 / F-5 / F-6 — LOW

• F-4 mcp-live-inspect.mjs:296 spawns the scanned target's declared MCP command (array-arg, no metachar injection). By-design for /security mcp-inspect, but scanning an untrusted target launches attacker-declared processes — add a confirm before spawning servers from a non-home target.
• F-5/F-6 two stray committed root artifacts: --json (0-byte redirect husk) and .orphaned_at. Inert; git rm them.

Closing gates (when fixing)

• TDD per fix (repro → red → green). Full node --test suite green.
• gitleaks clean. Re-run the F-1 repro to confirm the sink is closed.
• Then push: the F-1 fix commit + review-2026-06-20.md + this brief, together. After that the disclosure hold is lifted.
• Fixing F-1/F-2/F-3 lifts the plugin from B− to a solid A−.