fix(tools): use execFile instead of exec to avoid shell injection#5197

Draft

marcoscaceres wants to merge 9 commits intomainfrom

alert-autofix-47

Commits on Apr 17, 2026

Potential fix for code scanning alert no. 47: Shell command built from environment values

marcoscaceres
and
github-advanced-security[bot]
committed
fix(tools): use execFile instead of exec to avoid shell injection

Copilot
and
marcoscaceres
committed
fix(tools): format splitArgs with prettier

Copilot
and
marcoscaceres
committed
fix(tools): use structured args instead of regex parser
marcoscaceres
committed
fix(tools): accept string[] cmd to preserve quoted args and paths with spaces

Copilot
and
marcoscaceres
authored
fix(tools): convert all command runner calls to array syntax

Copilot
and
marcoscaceres
authored
Merge branch 'main' into alert-autofix-47
marcoscaceres
authored
chore(tools): remove dead string fallback in commandRunner
marcoscaceres
committed

Commits on Apr 19, 2026

Merge branch 'main' into alert-autofix-47
marcoscaceres
authored