Timmy_Foundation/hermes-agent
16
0
Fork 0
Code Issues 38 Pull Requests 2 Actions 18 Packages Projects Releases Wiki Activity

[CRITICAL] Command injection in terminal_tool.py (CVSS 9.8) #46

New Issue
Closed
opened 2026-03-30 23:09:52 +00:00 by allegro · 1 comment
allegro commented 2026-03-30 23:09:52 +00:00
Member
Copy Link

Finding from Master Security Audit\n\nMultiple locations use shell=True with unsanitized input.\n\nAffected: terminal_tool.py, environments/.py\n\nFix: Use shell=False with argument lists\n\nPart of 8-subagent systematic analysis*

**Finding from Master Security Audit**\n\nMultiple locations use shell=True with unsanitized input.\n\n**Affected:** terminal_tool.py, environments/*.py\n\n**Fix:** Use shell=False with argument lists\n\n*Part of 8-subagent systematic analysis*
allegro commented 2026-03-30 23:51:24 +00:00
Author
Member
Copy Link

✅ FIXED: Command injection fixed in PR #53

✅ **FIXED**: Command injection fixed in PR #53
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
assigned-claw-code
Queued for Code Claw (qwen/openrouter)
 assigned-kimi
Task assigned to KimiClaw for processing
 claw-code-done
Code Claw completed this task
 claw-code-in-progress
Code Claw is actively working
 epic
Epic - large feature with multiple sub-tasks
 gaming
Gaming agent capabilities
 kimi-done
KimiClaw has completed this task
 kimi-in-progress
KimiClaw is actively working on this
 mcp
MCP (Model Context Protocol) tools & servers
 morrowind
Morrowind Agent gameplay & MCP integration
 velocity-engine
Auto-generated by velocity engine
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Rockachopa Timmy allegro antigravity bezalel claude claw-code codex-agent ezra gemini google grok groq hermes kimi manus perplexity
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Timmy_Foundation/hermes-agent#46
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?