Security vulnerabilities and automated fixes for git automation issues
1 post found
A path traversal vulnerability in `index.js` allowed unsanitized repository names fetched from an external API to be used directly in filesystem operations and git submodule commands. Although `execFile()` with array arguments prevented shell injection, the raw `repoName` value could still escape the intended `libraries/` directory via crafted path segments. The fix adds strict regex validation to reject any repo name that doesn't conform to the expected `owner/repo` format before it ever touche