Security: $VAR/${VAR} variable expansion bypass in detectBashSubstitution and detectPowerShellSubstitution (GHSA-wpqr-6v78-jr5g)

[thalha-a9]

Description

The shell command detection functions in packages/core/src/utils/shell-utils.ts have an incomplete check that allows certain variable expansion patterns to bypass the security gate added for GHSA-wpqr-6v78-jr5g. This affects both bash and PowerShell code paths.

Details are intentionally kept minimal as this is an active security issue. Full technical details are in PR #28403.

Fix

PR #28403 addresses this with comprehensive detection, safe-variable allowlisting, and dual-platform test coverage (120 tests passing).

[thalha-a9]

@kschaab @SandyTao520 Hi, this issue addresses an incomplete fix for an existing public advisory (GHSA-wpqr-6v78-jr5g). The current detection can still be bypassed. A fix with full test coverage is ready in PR #28403. Could a maintainer apply the help-wanted label and approve the required CI/E2E checks? Thanks!