漏洞关键信息 漏洞类型 Shell Injection via variable substitution - CVE Identifier: GHSA-vqqr-rmpc-hhg2 漏洞细节 Work Directory Injection: attacker can exploit unquoted variables embedded in shell scripts to break out of quotes CVSS Score: 8.2 (High), context-dependent 修复措施 Proper Escaping: Added escaping of single quotes in shell commands to prevent injection - function implemented in - in for shell scripts Testing: - Comprehensive test suite with 25+ test cases - Validates against real-world attacks from security advisories 变更文件 5 Files Changed: - : +322 -8 lines changed - : +16 -1 lines changed - : +33 lines changed - : +5 -3 lines changed - : +268 lines changed Functionality Enhancements: Implementation of to safely quote strings for shell commands 安全测试 Added comprehensive test cases to validate the shell quoting function Test vectors include: , , , and more