Skip to content

v1.0.1

Choose a tag to compare

View all tags
@bereilhp bereilhp released this 14 Mar 13:07
· 2 commits to main since this release
v1.0.1
89d348d

This patch release addresses a critical security vulnerability in the git command execution and updated the output format.

Security Fixes

  • Replaced execSync with spawnSync: The previous implementation used execSync with a string argument, which allowed shell metacharacters (;, &&, ||, |, backticks, $()) to be interpreted by the shell. This could potentially allow remote code execution through prompt injection attacks.
  • Array-based command execution: Commands are now executed using spawnSync with an array of arguments, preventing shell interpretation of user input.
  • Improved argument tokenization: Added proper tokenization to handle quoted arguments correctly while maintaining security.

Features

New Output Format

The CLI output has been reorganized into a cleaner, more readable format:

  Model
  -------
  llama3.1-8b (Cerebras)

  Command
  -------
  git log -1

  Result
  -------
  abc1234 Commit message
Assets 2
Loading