# NousResearch/hermes-agent · shell=True subprocess command injection vulnerabilities

## Open now

- 2 issues, 4 PRs open on GitHub.
- #16560: Command injection via shell=True in tui_gateway/server.py
- #53140: \[Security\]\[HIGH\] Shell injection via config.yaml quick commands — no file ownership validation
- PR #35545: fix(security): convert shell=True to shlex.split in cli.py and mcp_catalog.py
- PR #53156: fix(config): reject unsafe config.yaml quick-command sources
- PR #127393: fix(tui-gateway): remove shell=True command injection from quick commands (#16560)
- PR #127408: fix(security): screen quick-command exec snippets through the approval guard (#16560)

Multiple reports and corresponding fixes address command injection risks from subprocess calls using shell=True across several components, including TUI gateway, CLI, config-driven execution paths, and STT handling. The work involves replacing shell=True with safer alternatives like shlex.split and adding fail-closed guards for dangerous-command checks.

## TL;DR

- 18 member(s): 2 open issue(s), 6 closed issue(s), 4 open PR(s), 0 merged PR(s), 6 PR(s) closed without merging.
- No fix has been merged to main; one or more PRs were attempted (see below).
- **Recommended:** review the prior/competing PR(s) below. A fix was attempted but not merged; your case may extend or revive that work.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `unresolved`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_PARTIAL`): some members are connected by structural evidence (shared changed files, or a closing/superseded reference); the rest are joined by an automated relevance judgement over their text.
- Members outside that structural core may belong to a different underlying problem.
- Pairwise link density `0.09`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Open related issues

- #16560: Command injection via shell=True in tui_gateway/server.py
- #53140: \[Security\]\[HIGH\] Shell injection via config.yaml quick commands — no file ownership validation

## Closed / duplicate issues

- #1241: \[Security\] subprocess invocation uses shell=True
- #10692: shell=True in config-driven execution paths bypasses terminal tool safety controls
- #45160: CRITICAL: TUI gateway server.py has 2 shell=True subprocess calls (lines 6367, 8512)
- #45572: Multiple command injection vectors via shell=True in subprocess calls
- #65557: Three sites use subprocess with shell=True on untrusted or user-influenced input
- #65729: Three sites use subprocess with shell=True on untrusted or user-influenced input

## Prior & competing PRs

- **#10698: fix(security): replace shell=True with shlex.split in config-driven execution paths**. closed without merge · fix tier `suggested`
  - maintainer direction: category `uncategorized`; implication `needs_llm`; refs `#10692`
  - _suggested-tier fix detail withheld; re-request with `?tier=all` to include it._
- **#41537: fix(security): remove shell=True command injection (tui_gateway + tools_config)**. closed without merge · fix tier `suggested`
  - maintainer direction: category `uncategorized`; implication `needs_llm`
  - _suggested-tier fix detail withheld; re-request with `?tier=all` to include it._
- **#15542: fix(security): fail-closed when dangerous-command guard cannot be loaded in TUI shell.exec**. closed without merge
  - maintainer direction: category `superseded_by_pr`; implication `superseded`; refs `c3055d61857751ad82a2bf9e4f5de5d26a8f2a16`, `0e8648cf74014e121d5b5fff2967891bbb6ebef6`, `c3055d61857751ad82a2bf9e4f5de5d26a8f2a16`, `0e8648cf74014e121d5b5fff2967891bbb6ebef6`
- **#17045: security(tui-gateway): fail-closed dangerous-command check in shell.exec / command.dispatch (#16560)**. closed without merge
  - maintainer direction: category `duplicate_of`; implication `duplicate`; refs `#15542`, `#15881`, `#16560`
- **#28214: fix(security): harden TUI gateway quick-commands exec path with centralized guard helper**. closed without merge
  - maintainer direction: category `implemented_elsewhere`; implication `superseded`; refs `#16560`, `#46056`, `#46057`
- **#35545: fix(security): convert shell=True to shlex.split in cli.py and mcp_catalog.py**. open
  - maintainer direction: category `implemented_elsewhere`; implication `superseded`
  - files: `hermes_cli/mcp_catalog.py`
- **#53156: fix(config): reject unsafe config.yaml quick-command sources**. open
  - maintainer direction: category `uncategorized`; implication `needs_llm`
  - files: `hermes_cli/config.py`, `tests/hermes_cli/test_config.py`
- **#65761: fix(security): remove shell=True from three subprocess.run sites**. closed without merge
  - maintainer direction: category `duplicate_of`; implication `duplicate`; refs `#65729`, `#65557`
- **#127393: fix(tui-gateway): remove shell=True command injection from quick commands (#16560)**. open
  - maintainer direction: category `uncategorized`; implication `needs_llm`
  - files: `tests/test_tui_gateway_server.py`, `tui_gateway/server.py`, `website/docs/user-guide/configuration.md`
- **#127408: fix(security): screen quick-command exec snippets through the approval guard (#16560)**. open
  - maintainer direction: category `implemented_elsewhere`; implication `superseded`
  - files: `cli.py`, `gateway/run_inbound.py`, `locales/af.yaml`, `locales/ar.yaml`, `locales/de.yaml`, `locales/en.yaml`, `locales/es.yaml`, `locales/fr.yaml`, `locales/ga.yaml`, `locales/hu.yaml`, `locales/it.yaml`, `locales/ja.yaml`, `locales/ko.yaml`, `locales/pt.yaml`, `locales/ru.yaml`, `locales/tr.yaml`, `locales/uk.yaml`, `locales/zh-hant.yaml`, `locales/zh.yaml`, `tests/gateway/test_quick_command_guard.py` (+3 more)

## Fix status

- No merged fix on record.
- Subsystem: `gateway`