v1.5.2 — Security: command injection via build configuration

Update promptly

This release fixes a critical security issue. Versions 1.5.0 and 1.5.1 could
execute arbitrary commands while building a project — cloning a repository and
running rune build was enough. The compiled program never had to be run, and
nothing indicated anything unusual had happened.

Update rune to 1.5.1 as well. Both tools construct command lines, and both
were affected. Updating only one leaves the path open.

What was wrong

torvc interpolated the --arch target triple into the clang command line
without validating it, so a value containing shell syntax ran at build time. That
value can be set from a project's torvik.rune manifest, which is what made it
reachable through ordinary use rather than only through a hand-typed flag.

--entry was affected the same way. It is written directly into generated LLVM
IR, so a crafted value could inject arbitrary IR into the compiled program.

What changed

Both values are validated against an allowlist. A target triple may contain
letters, digits and _ . -; an entry symbol follows C identifier rules. Anything
else is refused with a message naming the field and explaining the limit.

Quoting was considered and rejected as insufficient: shell double-quoting stops
word-splitting but not command substitution — "$(...)" still expands — so
every value reaching a shell is validated instead.

If you have already built an untrusted project

Treat that build as having run arbitrary code with your user's privileges.

Install:

Linux

curl -fsSL https://raw.githubusercontent.com/torvik-lang/torvik/main/linux/install.sh | sh

Windows (PowerShell)

iwr -useb https://raw.githubusercontent.com/torvik-lang/torvik/main/windows/install.ps1| iex

Already have Torvik?

rune update

No source changes are required and nothing about the language changed.

Full details: SECURITY.md, advisory TV-2026-001.