Cairn

shell=True subprocess command injection vulnerabilities

NousResearch/hermes-agent · cluster 1241 · gateway

Data as of

6 open items. Fix attempted, not merged.

The short answer

2open issues
4open PRs
18items grouped
Known?
Yes. 18 related items grouped here, 6 issues already closed.
Fix event
No fix has been merged to main. 6 PRs closed without merging; see the attempts below.
Tracker
The maintainers' tracker marks this unresolved. That is separate from the fix event.
Still open
2 issues and 4 PRs.

Multiple reports and corresponding fixes address command injection risks from subprocess calls using shell=True across several components, including TUI gateway, CLI, config-driven execution paths, and STT handling. The work involves replacing shell=True with safer alternatives like shlex.split and adding fail-closed guards for dangerous-command checks.

Open issues2

  • Issue#16560Command injection via shell=True in tui_gateway/server.py
  • Issue#53140[Security][HIGH] Shell injection via config.yaml quick commands — no file ownership validation

Open PRs4

  • PR#35545fix(security): convert shell=True to shlex.split in cli.py and mcp_catalog.py
  • PR#53156fix(config): reject unsafe config.yaml quick-command sources
  • PR#127393fix(tui-gateway): remove shell=True command injection from quick commands (#16560)
  • PR#127408fix(security): screen quick-command exec snippets through the approval guard (#16560)

6 PRs closed without merging

From the close comments: duplicate 2 · done elsewhere 1 · superseded by another PR 1 · other 2

  • #10698 fix(security): replace shell=True with shlex.split in config-driven execution paths · other → #10692
  • #15542 fix(security): fail-closed when dangerous-command guard cannot be loaded in TUI shell.exec · superseded by another PR → c3055d6, 0e8648c
  • #17045 security(tui-gateway): fail-closed dangerous-command check in shell.exec / command.dispatch (#16560) · duplicate → #15542, #15881, #16560
  • #28214 fix(security): harden TUI gateway quick-commands exec path with centralized guard helper · done elsewhere → #16560, #46056, #46057
  • #41537 fix(security): remove shell=True command injection (tui_gateway + tools_config) · other
Show 1 more
  • #65761 fix(security): remove shell=True from three subprocess.run sites · duplicate → #65729, #65557
Closed issues · 6
  • Closed#1241[Security] subprocess invocation uses shell=True
  • Closed#10692shell=True in config-driven execution paths bypasses terminal tool safety controls
  • Closed#45160CRITICAL: TUI gateway server.py has 2 shell=True subprocess calls (lines 6367, 8512)
  • Closed#45572Multiple command injection vectors via shell=True in subprocess calls
  • Closed#65557Three sites use subprocess with shell=True on untrusted or user-influenced input
  • Closed#65729Three sites use subprocess with shell=True on untrusted or user-influenced input
How this cluster was grouped
  • Link evidence (partly structural links): some members are connected by structural evidence (shared changed files, or a closing/superseded reference); the rest are joined by an automated relevance judgement over their text.
  • Members outside that structural core may belong to a different underlying problem.
  • Pairwise link density 0.09: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
gateway
Closed issues
6
Attempts
6 PRs closed without merging

For your agent

The same facts, typed.

cluster/1241.json
cluster/1241.md