{"repo":"NousResearch/hermes-agent","public_id":"126939","display_label":"WSL external URL handling security and fix","summary":"A security vulnerability was identified where external URLs in WSL were passed to cmd.exe in a way that allowed command injection via metacharacters like `&`. The related items address this by switching to rundll32 and blocking dangerous inputs.","subsystem":"apps/desktop","counts":{"members":4,"open_issues":1,"open_issues_distinct":1,"open_prs":2,"closed_issues":0,"merged_prs":0,"attempt_prs":3},"landed_fix":null,"resolution":{"state":"unresolved","by":null},"freshness":{"state":"never_verified","last_verified_at":null,"is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.5},"fix_edges":[],"members":[{"kind":"issue","number":126939,"title":"[Security] WSL external-link path hands a URL to `cmd.exe` with only a scheme allowlist, enabling `&`-delimited command execution","url":null,"state":"open"},{"kind":"pr","number":126968,"title":"fix(desktop): fail WSL link opens closed on cmd.exe metacharacters","url":null,"state":"open","close_reason":{"refs":[{"kind":"pr","value":"#88558","number":88558},{"kind":"pr","value":"#124314","number":124314}],"category":"uncategorized","implication":"needs_llm"},"merged":false},{"kind":"pr","number":126974,"title":"fix(desktop): hand WSL external URLs to rundll32 instead of cmd.exe start","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#129631","number":129631},{"kind":"pr","value":"#129631","number":129631}],"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":129631,"title":"fix(desktop): hand WSL external URLs to rundll32, not cmd.exe","url":null,"state":"open","close_reason":{"category":"uncategorized","implication":"needs_llm"},"merged":false}],"trust":{"default_tier":"verified","includes_suggested":false}}