{"repo":"NousResearch/hermes-agent","public_id":"71296","display_label":"Shell injection via newlines in session env snapshots","summary":"A bug allows newlines in chat metadata or environment variables to execute shell commands through session snapshots. Multiple fix attempts address sanitizing or filtering multiline content in the snapshot pipeline.","subsystem":"environments","counts":{"members":7,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":5},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":72355},"resolution":{"state":"resolved","by":"pr-72355"},"freshness":{"state":"verified","last_verified_at":"2026-07-27T02:30:03+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.2857142857142857},"fix_edges":[{"issue_number":71296,"pr_number":72355,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true}],"members":[{"kind":"issue","number":71296,"title":"[Bug]: Newline in a Matrix room/display name runs shell commands on the gateway host","url":null,"state":"closed"},{"kind":"pr","number":71306,"title":"fix(environments): stop multiline session env from becoming shell via snapshot","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#72355","number":72355}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":71356,"title":"fix(security): sanitize newlines in chat metadata to prevent shell injection via env snapshot","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#71306","number":71306},{"kind":"pr","value":"#71296","number":71296},{"kind":"pr","value":"#71309","number":71309}],"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":71414,"title":"fix(terminal): filter multiline continuation lines in env snapshot (#71296)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"9677495004ef9a3460d4b29748e916db600b1b1e","number":0}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":71464,"title":"fix(terminal): prevent session snapshot injection","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"6290cd0d5","number":0},{"kind":"pr","value":"#71296","number":71296}],"category":"implemented_elsewhere","implication":"superseded"},"merged":false},{"kind":"pr","number":71974,"title":"fix(tools): harden session-snapshot filter against multiline injection (#71296)","url":null,"state":"closed","close_reason":{"category":"silent_close","implication":"active"},"merged":false},{"kind":"pr","number":72355,"title":"fix(environments): stop multiline session env from becoming shell via snapshot (salvage of #71306 by @HexLab98)","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["tests/tools/test_snapshot_multiline_session_env_injection.py","tests/tools/test_snapshot_session_id_leak.py","tools/environments/base.py"]}],"trust":{"default_tier":"verified","includes_suggested":false}}