Fix shell injection vulnerability and preserve command substitution syntax - #26

Merged

Intuity merged 6 commits into

Intuity:mainfrom

EdNutting:ednutting/fix-shell-injection

Jan 26, 2026

Commits on Jan 15, 2026

Fix shell injection vulnerability in LocalScheduler

EdNutting
and
claude
committed
842e360
Fix expandvars stripping command substitution syntax from job args

EdNutting
and
claude
committed
86be306
Add quote-aware parsing to command substitution detection
EdNutting
committed
a11045d
Warn users when command substitutions are detected in non-shell commands

EdNutting
and
claude
committed
75cdaac
Upgrade to new expandvars package version
EdNutting
committed
ea9aabe

Commits on Jan 24, 2026

Merge branch 'main' into ednutting/fix-shell-injection
Intuity
authored
057fd88