Skip to content

fix(core): block $VAR and ${VAR} variable expansion bypass (GHSA-wpqr-6v78-jr5g)#28403

Open
thalha-a9 wants to merge 7 commits into
google-gemini:mainfrom
thalha-a9:fix/variable-expansion-bypass
Open

fix(core): block $VAR and ${VAR} variable expansion bypass (GHSA-wpqr-6v78-jr5g)#28403
thalha-a9 wants to merge 7 commits into
google-gemini:mainfrom
thalha-a9:fix/variable-expansion-bypass

Update packages/core/src/utils/shell-utils.ts

ff4323d
Select commit
Loading
Failed to load commit list.
Google CLA / cla/google succeeded Jul 15, 2026 in 20s

✅ All contributors are covered under a CLA with Google

See https://cla.developers.google.com/ for more info about Google's Contributor License Agreement (CLA).

ℹ️ Googlers: Go here to view more details and manage scans for this pull request.

Details

The following contributors were found for this pull request:

ff4323d Author: @thalha-a9 <Shei*******035​@gmail.com>, <shei*******035​@gmail.com>
ff4323d Co-Author: @gemini-code-assist[bot] <176961590+gemini-code-assist[bot]​@users.noreply.github.com>

(Only the first commit for a unique contributor is listed.)