Issue Station
Sign In
Tools hereToolbox

gemini-cli - 💡(How to fix) Fix Security: Command injection in findCommand via shell-interpolated execSync

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

The findCommand() function in packages/core/src/ide/ide-installer.ts uses execSync() with string interpolation to check if commands exist on PATH:

// Windows - line 32
child_process.execSync(`where.exe ${command}`)

// Unix - line 41
child_process.execSync(`command -v ${command}`)
``

This allows command injection if the `command` parameter contains shell metacharacters (e.g., `;`, `|`, backticks).

Root Cause

The findCommand() function in packages/core/src/ide/ide-installer.ts uses execSync() with string interpolation to check if commands exist on PATH:

// Windows - line 32
child_process.execSync(`where.exe ${command}`)

// Unix - line 41
child_process.execSync(`command -v ${command}`)
``

This allows command injection if the `command` parameter contains shell metacharacters (e.g., `;`, `|`, backticks).

Fix Action

Fix

PR #27575 replaces execSync with spawnSync using argument arrays (shell: false) and adds input validation.

RAW_BUFFERClick to expand / collapse

Description

The findCommand() function in packages/core/src/ide/ide-installer.ts uses execSync() with string interpolation to check if commands exist on PATH:

// Windows - line 32
child_process.execSync(`where.exe ${command}`)

// Unix - line 41
child_process.execSync(`command -v ${command}`)
``

This allows command injection if the `command` parameter contains shell metacharacters (e.g., `;`, `|`, backticks).

## Impact
High - arbitrary command execution on the host system.

## Fix
PR #27575 replaces `execSync` with `spawnSync` using argument arrays (`shell: false`) and adds input validation.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

gemini-cli - 💡(How to fix) Fix Security: Command injection in findCommand via shell-interpolated execSync