{"repo":"NousResearch/hermes-agent","public_id":"1241","display_label":"shell=True subprocess command injection vulnerabilities","summary":"Multiple reports and corresponding fixes address command injection risks from subprocess calls using shell=True across several components, including TUI gateway, CLI, config-driven execution paths, and STT handling. The work involves replacing shell=True with safer alternatives like shlex.split and adding fail-closed guards for dangerous-command checks.","subsystem":"gateway","counts":{"members":18,"open_issues":2,"open_issues_distinct":2,"open_prs":4,"closed_issues":6,"merged_prs":0,"attempt_prs":10},"landed_fix":null,"resolution":{"state":"unresolved","by":null},"freshness":{"state":"never_verified","last_verified_at":null,"is_stale":false},"grouping":{"backbone":"STRUCTURAL_PARTIAL","link_density":0.090718954248366},"fix_edges":[],"members":[{"kind":"issue","number":1241,"title":"[Security] subprocess invocation uses shell=True","url":null,"state":"closed"},{"kind":"issue","number":10692,"title":"shell=True in config-driven execution paths bypasses terminal tool safety controls","url":null,"state":"closed"},{"kind":"issue","number":16560,"title":"Command injection via shell=True in tui_gateway/server.py","url":null,"state":"open"},{"kind":"issue","number":45160,"title":"CRITICAL: TUI gateway server.py has 2 shell=True subprocess calls (lines 6367, 8512)","url":null,"state":"closed"},{"kind":"issue","number":45572,"title":"Multiple command injection vectors via shell=True in subprocess calls","url":null,"state":"closed"},{"kind":"issue","number":53140,"title":"[Security][HIGH] Shell injection via config.yaml quick commands — no file ownership validation","url":null,"state":"open"},{"kind":"issue","number":65557,"title":"Three sites use subprocess with shell=True on untrusted or user-influenced input","url":null,"state":"closed"},{"kind":"issue","number":65729,"title":"Three sites use subprocess with shell=True on untrusted or user-influenced input","url":null,"state":"closed"},{"kind":"pr","number":10698,"title":"fix(security): replace shell=True with shlex.split in config-driven execution paths","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#10692","number":10692}],"category":"uncategorized","implication":"needs_llm"},"merged":false,"is_fix_pr":true,"fix_tier":"suggested","fix_detail_withheld":true},{"kind":"pr","number":15542,"title":"fix(security): fail-closed when dangerous-command guard cannot be loaded in TUI shell.exec","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"c3055d61857751ad82a2bf9e4f5de5d26a8f2a16","number":0},{"kind":"commit","value":"0e8648cf74014e121d5b5fff2967891bbb6ebef6","number":0},{"kind":"commit","value":"c3055d61857751ad82a2bf9e4f5de5d26a8f2a16","number":0},{"kind":"commit","value":"0e8648cf74014e121d5b5fff2967891bbb6ebef6","number":0}],"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":17045,"title":"security(tui-gateway): fail-closed dangerous-command check in shell.exec / command.dispatch (#16560)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#15542","number":15542},{"kind":"pr","value":"#15881","number":15881},{"kind":"pr","value":"#16560","number":16560}],"category":"duplicate_of","implication":"duplicate"},"merged":false},{"kind":"pr","number":28214,"title":"fix(security): harden TUI gateway quick-commands exec path with centralized guard helper","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#16560","number":16560},{"kind":"pr","value":"#46056","number":46056},{"kind":"pr","value":"#46057","number":46057}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":35545,"title":"fix(security): convert shell=True to shlex.split in cli.py and mcp_catalog.py","url":null,"state":"open","close_reason":{"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":41537,"title":"fix(security): remove shell=True command injection (tui_gateway + tools_config)","url":null,"state":"closed","close_reason":{"category":"uncategorized","implication":"needs_llm"},"merged":false,"is_fix_pr":true,"fix_tier":"suggested","fix_detail_withheld":true},{"kind":"pr","number":53156,"title":"fix(config): reject unsafe config.yaml quick-command sources","url":null,"state":"open","close_reason":{"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":65761,"title":"fix(security): remove shell=True from three subprocess.run sites","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#65729","number":65729},{"kind":"pr","value":"#65557","number":65557}],"category":"duplicate_of","implication":"duplicate"},"merged":false},{"kind":"pr","number":127393,"title":"fix(tui-gateway): remove shell=True command injection from quick commands (#16560)","url":null,"state":"open","close_reason":{"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":127408,"title":"fix(security): screen quick-command exec snippets through the approval guard (#16560)","url":null,"state":"open","close_reason":{"category":"implemented_elsewhere","implication":"superseded"},"merged":false}],"trust":{"default_tier":"verified","includes_suggested":false}}