Fix: LSP spawns planted project node_modules/.bin binaries on host (RCE, sandbox bypass)

[superagent-security-dev]

Summary

Stop resolving/spawning binaries from the project's own node_modules/.bin: remove the findLocalBinary preference in resolveCommand so server binaries come only from PATH / the npm cache, or from an explicit builtins..command override in .grok/settings.json (the gated, documented path). Also remove the now-unused findLocalBinary helper. This is the smallest safe change that closes host RCE from a planted project binary while preserving pinned-server configuration via the existing override mechanism.

Finding

LSP spawns planted project node_modules/.bin binaries on host (RCE, sandbox bypass)

Generated by Superagent from the proposed patch for this finding.

---

Note

High Risk
Security fix for host process spawning from untrusted repo content; behavior change may break repos that relied on implicit local .bin resolution without a settings override.

Overview
Closes a host RCE path where opening a malicious repo could cause built-in LSP servers to run an executable planted under the project's node_modules/.bin on the host (outside the sandbox, without workspace-trust gating).

resolveCommand no longer prefers a local .bin shim via the removed findLocalBinary helper—it only resolves via findCommandOnPath (and the existing npm-cache path in resolveNodeServerLaunch when auto-install applies). Project-pinned language servers remain supported through explicit builtins.<id>.command (and args) in .grok/settings.json.

^{Reviewed by Cursor Bugbot for commit cac92b6. Configure here.}

[open-cla]

Contributor License Agreement

All contributors are covered by a CLA.