open/llm-security
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity Actions
llm-security/docs
History
Kjell Tore Guttormsen 92bd99f2a8 docs: security fix brief for next session — F-1 RCE + F-2/F-3 sinks 
Action brief from the marketplace-wide review (see docs/review-2026-06-20.md). Three shell/path
injection sinks: F-1 CRITICAL zero-interaction RCE in git-forensics.mjs (execSync shell string +
attacker-controlled filenames; reproduced), F-2 HIGH path-containment write in auto-cleaner.mjs,
F-3 HIGH command injection in the supply-chain hook. Common fix: execSync(string) -> spawnSync(array)
/ input containment. DO AFTER the current active session finishes.

Disclosure hold: this brief + review-2026-06-20.md (ff9bd13) are committed locally but NOT pushed;
push both only together with the F-1 fix (the brief carries a working RCE repro payload).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ter3E2JSi1Khgmuf2kady8
2026-06-20 09:23:19 +02:00
..
plans docs(llm-security): research brief + URL-support plan for ide-scan 2026-04-17 18:47:01 +02:00
ci-cd-guide.md feat(ci): add CI/CD integration — --fail-on, --compact, pipeline templates 2026-04-10 14:59:05 +02:00
critical-review-2026-04-20.md docs(llm-security): add critical review 2026-04-20 (v7.0.0 adversarial audit) 2026-04-19 23:27:52 +02:00
defense-philosophy.md chore: WIP marketplace doc adjustments across plugins 2026-05-18 12:04:02 +02:00
review-2026-06-20.md docs: add full-depth plugin review (2026-06-20) 2026-06-20 09:14:11 +02:00
scanner-reference.md chore(llm-security): v7.7.2 — language consistency pass 2026-05-19 06:47:44 +02:00
security-fix-brief-2026-06-20.md docs: security fix brief for next session — F-1 RCE + F-2/F-3 sinks 2026-06-20 09:23:19 +02:00
security-hardening-guide.md docs(hardening-guide): 8.6 — sandbox-architecture rationale (no code consolidation) 2026-04-30 16:55:45 +02:00
version-history.md chore(llm-security): v7.7.2 — language consistency pass 2026-05-19 06:47:44 +02:00