Siyu Lou

A command approval bypass exists in the `getCommandDecision()` function. This issue allows attackers to auto-approve shell commands that should be denied by prefixing them with a bare `>&` redirect. By utilizing indirect prompt injection, an attacker can manipulate the allowlist to match a redirect target, such as `echo`, while the shell executes the denied command on the developer machine.

A command approval bypass exists due to the abuse of quote-masking regex within the `parseCommandLine()` function. This allows attackers to use indirect prompt injection—a technique where malicious instructions are embedded in data processed by the system—using escaped or single-quoted double quotes. By hiding command separators behind allowlisted prefixes such as echo, unauthorized shell commands can be executed without user approval.

A command approval bypass exists where the `parseCommandLine()` function incorrectly treats `${ command; }` substitutions as parameter expansions. This allows attackers to use indirect prompt injection to embed denied commands within an allowlisted command, such as `echo`, enabling the execution of unauthorized shell commands without user approval on bash 5.3+ or ksh93.

A command approval bypass exists in the `parseCommandLine()` function. The issue occurs when command substitutions are placed adjacent to `*` or `?` glob characters, causing them to be discarded during parsing. An attacker can leverage indirect prompt injection to craft commands, such as `echo *$(...)`, that appear to match allowlisted prefixes. This allows the execution of denied commands without user approval when the auto-approval feature is enabled.

A command approval bypass exists in the `parseCommandLine()` function. This issue allows attackers to auto-approve arbitrary shell commands by placing a command substitution in the command position. By utilizing indirect prompt injection, an attacker can submit commands such as `$(echo touch /tmp/x)` that bypass the `echo` allowlist check, leading the shell to execute the output without requiring user approval.