{"repo":"NousResearch/hermes-agent","public_id":"2743","display_label":"Subprocess shell injection hardening and security fixes","summary":"These items address command injection vulnerabilities in subprocess calls, focusing on eliminating shell=True usage, scrubbing environment variables, enforcing path guards, and adding idle timeouts for TTS/STT providers.","subsystem":"environments","counts":{"members":3,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":1},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":73514,"merged_at":"2026-07-29T01:12:26+00:00"},"resolution":{"state":"resolved","by":"pr-73514"},"freshness":{"state":"verified","last_verified_at":"2026-07-29T01:12:26+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.6666666666666666},"fix_edges":[{"issue_number":2743,"pr_number":73514,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-07-29T01:12:26+00:00"},{"issue_number":50081,"pr_number":73514,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-07-29T01:12:26+00:00"},{"issue_number":50612,"pr_number":73514,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true,"pr_merged_at":"2026-07-29T01:12:26+00:00"}],"members":[{"kind":"issue","number":2743,"title":"[Bug]: Command injection risk via shell=True in subprocess calls","url":null,"state":"closed"},{"kind":"pr","number":2750,"title":"fix(security): harden subprocess calls against shell injection","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#5629","number":5629}],"category":"uncategorized","implication":"needs_llm"},"merged":false,"is_fix_pr":true,"fix_tier":"suggested","fix_detail_withheld":true},{"kind":"pr","number":73514,"title":"fix(tools): command TTS/STT provider hardening — idle timeouts, env scrubbing, no-shell, path guards","url":null,"state":"merged","close_reason":{"category":"merged"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["tests/tools/test_transcription_tools.py","tests/tools/test_tts_command_providers.py","tests/tools/test_tts_path_traversal.py","tests/tools/test_voice_mode_playback_env_scrub.py","tools/transcription_tools.py","tools/tts_tool.py","tools/voice_mode.py","website/docs/developer-guide/plugins/index.md","website/docs/user-guide/features/tts.md"]}],"trust":{"default_tier":"verified","includes_suggested":false}}