Repository navigation
A security release, and the end of a family
of issues.
Update if you run torvc from a script, a CI job, or anywhere HOME is set from
configuration rather than by logging in. If you only ever type torvc yourself at
a prompt you already control, this is not urgent — but it is small and there is no
reason to wait.
Security — TV-2026-003, shell injection via paths
Every path the compiler put on a command line — the output path from -o, the run
directory derived from HOME, temporary objects, link scripts — went through one
quoting helper that wrapped it in double quotes.
Double quotes do not stop command substitution. $(...) and backticks expand
inside them. So a path containing shell syntax executed with the privileges of
whoever ran torvc.
Two vectors were confirmed:
torvc x.tv -o '$(command)'
HOME='/tmp/x$(command)' torvc x.tv runThe second matters more than it looks. Any context where HOME comes from
configuration — CI runners, container entrypoints, service accounts, wrapper
scripts — was exposed without the caller passing anything unusual.
The fix. The quoting helper now refuses a path containing shell syntax
instead of quoting it. The check lives in that one function, so all seventeen call
sites are covered at once. Ordinary paths are unaffected.
Why this is the seventh, and what changed because of that
TV-2026-003 is the seventh command-injection issue found in Torvik, and the last of
a family. They shared one cause: the compiler builds command lines for clang and
the linker, and values reached those command lines without being checked.
Each earlier fix was correct and incomplete — it closed the site that had been
found and left the others open. Manifest fields were fixed in 1.5.2, torvc run
arguments in 1.5.3, and this release fixes the helper all of them ultimately passed
through.
Two things changed beyond the fix itself:
A rule. No path or user-supplied string reaches a command line without passing
a validator, and the validators refuse rather than escape. Escaping has to be
correct on two different shells and stays correct only until either changes.
A gate. The test suite now reads the compiler's own source and fails if a value
reaches a command line without a validator. A runtime check cannot stop a mistake
made while writing the compiler; this can. It was tested by deliberately
reintroducing the vulnerability and confirming the gate catches it — an earlier
version of the gate passed the clean tree and missed the reintroduced bug, which
is worse than having no gate at all.
If you write tooling around torvc, this is worth a look at your own wrappers. A
script that builds a torvc command line from a filename, a branch name, or any
value it did not choose has the same problem, and updating Torvik does not fix your
script.
Upgrading
rune updateNothing in this release changes the language or the standard library. No source
changes are required.