Repository navigation
Security concern with subprocess.run shell=True in _utilities.py and _terminal.py #875
Description
Hi @haesleinhuepf,
I was reviewing the git-bob source code and found a potential
security concern related to the use of shell=True in subprocess.run()
combined with unsanitized user inputs from sys.argv.
I would prefer to discuss the details privately before making
them public. Could you please enable GitHub's Private Vulnerability
Reporting for this repository, or share a preferred contact method
for security disclosures?
I am happy to provide a full technical write-up once a private
channel is established.
Best regards,
Sivaaditya Panuganti
Activity
haesleinhuepf commentedon May 29, 2026
Hey @sivaadityacoder ,
sure, just drop me an email.
git-bob/setup.cfg
Line 9 in 1befa11
I'm looking forward to hear what you think.
Best,
Robert
Merge pull request #876 from haesleinhuepf/fix-cli