Skip to content

fix: shell injection in tui_gateway/server.py (ISSUE-001) #33503

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ErnestHysa wants to merge 2 commits into
base: main
Choose a base branch
from
+16 −12
Open

fix: shell injection in tui_gateway/server.py (ISSUE-001) #33503

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b6cfb52
Apply least-privilege execute permissions on installed binaries
ErnestHysa May 27, 2026
8085e46
fix: prevent shell injection in tui_gateway/server.py
ErnestHysa May 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion tools/tirith_security.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -423,7 +423,7 @@ def _install_tirith(*, log_failures: bool = True) -> tuple[str | None, str]:
except OSError:
pass
return None, "cross_device_copy_failed"
os.chmod(dest, os.stat(dest).st_mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)
os.chmod(dest, os.stat(dest).st_mode | stat.S_IXUSR)

@teknium1 teknium1 Jul 13, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OR-ing S_IXUSR retains any existing S_IXGRP and S_IXOTH bits from the extracted or copied binary. Clear those bits explicitly if this change is intended to guarantee owner-only execution.


verification = "cosign + SHA-256" if cosign_verified else "SHA-256 only"
logger.info("tirith installed to %s (%s)", dest, verification)
Expand Down
26 changes: 15 additions & 11 deletions tui_gateway/server.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@
from pathlib import Path
from typing import Any, Optional

from tools.approval import detect_dangerous_command
from hermes_constants import get_hermes_home
from hermes_cli.env_loader import load_hermes_dotenv
from utils import is_truthy_value
Expand Down Expand Up @@ -4954,8 +4955,16 @@ def _(rid, params: dict) -> dict:
if name in qcmds:
qc = qcmds[name]
if qc.get("type") == "exec":

@teknium1 teknium1 Jul 13, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please also check detect_hardline_command before this dangerous-command check. Current shell.exec applies the hardline block first (tui_gateway/server.py:14403-14412); the quick-command path should preserve the same unconditional safety boundary.

cmd = qc.get("command", "")
is_dangerous, _, desc = detect_dangerous_command(cmd)
if is_dangerous:
return _err(
rid,
4005,
f"blocked: {desc}. Use the agent for dangerous commands.",
)
r = subprocess.run(
qc.get("command", ""),
cmd,
shell=True,
capture_output=True,
text=True,
Expand Down Expand Up @@ -6969,16 +6978,11 @@ def _(rid, params: dict) -> dict:
cmd = params.get("command", "")
if not cmd:
return _err(rid, 4004, "empty command")
try:
from tools.approval import detect_dangerous_command

is_dangerous, _, desc = detect_dangerous_command(cmd)
if is_dangerous:
return _err(
rid, 4005, f"blocked: {desc}. Use the agent for dangerous commands."
)
except ImportError:
pass
is_dangerous, _, desc = detect_dangerous_command(cmd)
if is_dangerous:
return _err(
rid, 4005, f"blocked: {desc}. Use the agent for dangerous commands."
)
try:
r = subprocess.run(
cmd, shell=True, capture_output=True, text=True, timeout=30, cwd=os.getcwd()
Expand Down