From 315e29a2d1d31895b16c144220aabd96cb604726 Mon Sep 17 00:00:00 2001 From: davincidreams Date: Mon, 27 Apr 2026 05:03:04 -0400 Subject: [PATCH] fix(security): escape backslashes and cmd metacharacters in hook executor Backslashes were not escaped before double-quotes in the PowerShell command wrapper, so paths like C:\foo\" would terminate the string early and allow injection. cmd /c wrapper had no escaping at all. Co-Authored-By: Claude Sonnet 4.6 --- src/core/hooks/executor.ts | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/core/hooks/executor.ts b/src/core/hooks/executor.ts index cb1b272ab5..2b4b2479c9 100644 --- a/src/core/hooks/executor.ts +++ b/src/core/hooks/executor.ts @@ -71,9 +71,13 @@ async function executeCommandHook( // Wrap command for different shells if (shell === "powershell") { - command = `powershell -Command "${command.replace(/"/g, '\\"')}"` + // Escape backslashes first, then double-quotes, to prevent shell injection + const escaped = command.replace(/\\/g, "\\\\").replace(/"/g, '\\"') + command = `powershell -Command "${escaped}"` } else if (shell === "cmd") { - command = `cmd /c "${command}"` + // Escape % (variable expansion) and ^ (cmd escape char) to prevent injection + const escaped = command.replace(/\^/g, "^^").replace(/%/g, "%%") + command = `cmd /c "${escaped}"` } try {