google-gemini / google-gemini/gemini-cli
Security: $VAR/${VAR} variable expansion bypass in detectBashSubstitution and detectPowerShellSubstitution (GHSA-wpqr-6v78-jr5g)
- Dominant language
- TypeScript
- Stars
- 107k
- Forks
- 14.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 45
Description
## Description
The shell command detection functions in `packages/core/src/utils/shell-utils.ts` have an incomplete check that allows certain variable expansion patterns to bypass the security gate added for GHSA-wpqr-6v78-jr5g. This affects both bash and PowerShell code paths.
Details are intentionally kept minimal as this is an active security issue. Full technical details are in PR #28403.
## Fix
PR #28403 addresses this with comprehensive detection, safe-variable allowlisting, and dual-platform test coverage (120 tests passing).
Contributor guide
Research direction
Start with packages/core/src/utils/shell-utils.ts and read PR #28403, since the issue intentionally omits the technical details and the fix is already described there. Review the bash and PowerShell paths and their dual-platform tests; done means comprehensive detection, safe-variable allowlisting, and the reported 120 tests passing.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100