From 5567ebd40bcb9fd6f43a5ee3d6a85a94c8dd11e9 Mon Sep 17 00:00:00 2001 From: tomaioo Date: Tue, 21 Jul 2026 23:43:09 -0700 Subject: [PATCH] fix(security): argument injection in git add command In `lib/git.js`, the `add` function passes the `files` array directly into the `execa` arguments for `git add`. If a file path contains strings that start with `-` (e.g., `-u` or `--all`), `git` may interpret them as command-line options rather than file paths. This can lead to argument injection, potentially allowing unintended files to be staged or other git options to be triggered. Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com> --- lib/git.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/git.js b/lib/git.js index 7cf26280..8983bd63 100644 --- a/lib/git.js +++ b/lib/git.js @@ -26,7 +26,7 @@ export async function getModifiedFiles(execaOptions) { export async function add(files, execaOptions) { const shell = await execa( "git", - ["add", "--force", "--ignore-errors", ...files], + ["add", "--force", "--ignore-errors", "--", ...files], { ...execaOptions, reject: false }, ); debug("add file to git index", shell);