v1.5.1 — Security: command injection via torvik.rune

Update promptly

This release fixes a critical security issue. Version 1.5.0 and earlier could
execute arbitrary commands during an ordinary rune build — cloning a repository
and building it was enough. The compiled program never had to be run.

Update Torvik to 1.5.2 as well. Both tools were independently affected.

What was wrong

rune builds the torvc command line by interpolating values read from a
project's torvik.rune. Those values were not validated, so a manifest
containing shell syntax executed arbitrary commands. Affected fields: name,
and under [build], entry, arch, link-script and link-with.

What changed

All manifest values are validated before use. Names, entry symbols and target
triples are restricted to a character allowlist; paths are screened for shell
metacharacters. A rejected value produces a clear message naming the field.

A manifest may also define a custom runner command, which rune run executes
by design. That is not a vulnerability — it is the feature's purpose, and rune
prints the command before running it — but it is a good reason to read an
unfamiliar torvik.rune before running anything from it.

Upgrading

rune installs with Torvik. To install just rune:

Linux

curl -fsSL https://raw.githubusercontent.com/torvik-lang/rune/main/linux/install.sh | sh

Windows (PowerShell)

iwr -useb https://raw.githubusercontent.com/torvik-lang/rune/main/windows/install.ps1 >| iex

Already installed?: rune self-update No manifest changes are required for any project whose values were
already ordinary.

Full details: SECURITY.md, advisory RUNE-2026-001.