hermes - 💡(How to fix) Fix [workflow-engine] CRITICAL: variable substitution crashes on regex metachars in user input

Severity: CRITICAL (correctness, user-input-triggered)

substitute_workflow_variables passes user-controlled values as the replacement argument to re.sub, which interprets \1, \g<0>, \\ as backreferences/escapes.

Evidence

plugins/workflow-engine/engine/core/executor_shared.py:157-177

result = re.sub(r"\$USER_MESSAGE", user_message, result)
result = re.sub(r"\$ARGUMENTS", user_message, result)
...
result = re.sub(r"\$CONTEXT", issue_context, result)

user_message / issue_context are fully attacker/user-controlled via POST /runs. A user_message of hello \1 raises re.error (verified), failing every prompt/bash/script node that references $USER_MESSAGE. Worse, a crafted \g<...> could pull unintended capture content.

Impact

Any workflow run whose user message contains a backslash-digit sequence crashes substitution. Denial-of-functionality; potential surprising text injection.

Fix

Use literal replacement — str.replace, or a lambda replacement so the value is never parsed:

result = re.sub(r"\$USER_MESSAGE", lambda _m: user_message, result)

or precompile and use re.sub(pat, lambda _m: val, result) uniformly.

Filed from opus-4.8 plugin audit (workflow-engine) vs upstream NousResearch plugin conventions.