Minqiang Gui

A command approval bypass exists in the `parseCommandLine()` function. This issue allows attackers to auto-approve arbitrary shell commands by placing a command substitution in the command position. By utilizing indirect prompt injection, an attacker can submit commands such as `$(echo touch /tmp/x)` that bypass the `echo` allowlist check, leading the shell to execute the output without requiring user approval.

A permission validation bypass allows attackers to execute unauthorized commands. This occurs due to a parsing discrepancy between tree-sitter-bash and bash when handling backslash-newline line continuations within the ` extract commands()` function of bash.py. An attacker can craft a command string where tree-sitter-bash identifies only an allowlisted prefix, such as cd, while bash interprets the line continuation as a different, hidden command, such as a curl request. This causes `resolve permission` to grant full permission, leading to the execution of arbitrary commands.

A command permission gate bypass allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value. This technique evades detection by tree-sitter-bash static parsing. By embedding a command substitution within a single-quoted variable and re-expanding it using the `${var@P}` prompt-transform operator, the bash promptvars feature executes the hidden command at runtime. This occurs while only the trailing allowlisted command is classified, leading to silent arbitrary command execution with the privileges of the agent's terminal session.

A command approval bypass exists in the `getCommandDecision()` function. This issue allows attackers to auto-approve shell commands that should be denied by prefixing them with a bare `>&` redirect. By utilizing indirect prompt injection, an attacker can manipulate the allowlist to match a redirect target, such as `echo`, while the shell executes the denied command on the developer machine.

A command approval bypass exists due to the abuse of quote-masking regex within the `parseCommandLine()` function. This allows attackers to use indirect prompt injection—a technique where malicious instructions are embedded in data processed by the system—using escaped or single-quoted double quotes. By hiding command separators behind allowlisted prefixes such as echo, unauthorized shell commands can be executed without user approval.

A command approval bypass exists where the `parseCommandLine()` function incorrectly treats `${ command; }` substitutions as parameter expansions. This allows attackers to use indirect prompt injection to embed denied commands within an allowlisted command, such as `echo`, enabling the execution of unauthorized shell commands without user approval on bash 5.3+ or ksh93.

A command approval bypass exists in the `parseCommandLine()` function. The issue occurs when command substitutions are placed adjacent to `*` or `?` glob characters, causing them to be discarded during parsing. An attacker can leverage indirect prompt injection to craft commands, such as `echo *$(...)`, that appear to match allowlisted prefixes. This allows the execution of denied commands without user approval when the auto-approval feature is enabled.

A word-boundary mismatch in comment handling between the approval gate's shell parser and bash allows the bypass of auto-approve restrictions. An attacker can execute denied shell commands by crafting a command string where an allowlisted word is immediately followed by a hash character, a separator, and the denied command. This causes the approval gate to permit the request while bash executes the restricted command using the agent's auto-execute privileges on the developer's machine.

A flaw in the shell command parsing logic allows the bypass of auto-approve restrictions. The issue stems from the omission of the bash pipe operator from the command parser's operator token set. An attacker can execute denied shell commands by crafting a command line that starts with an allowlisted prefix followed by the stderr-redirecting pipe operator and the denied command. This causes the parser to approve the entire pipeline, while bash executes the restricted component using the agent's auto-execute privileges on the developer's machine.

An issue with access restrictions was addressed through enhanced sandbox limitations. An application may potentially gain unauthorized access to the Local Network.