Skip to content

fix(security): guard cron script against path traversal and redact output #5093

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
memosr wants to merge 2 commits into from
Closed

fix(security): guard cron script against path traversal and redact output #5093

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
588050a
fix(security): guard cron script against path traversal and redact ou…
Apr 4, 2026
6a12e32
fix(security): restrict absolute cron script paths to HERMES_HOME
Apr 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 22 additions & 1 deletion cron/scheduler.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -248,7 +248,21 @@ def _run_job_script(script_path: str) -> tuple[bool, str]:
path = Path(script_path).expanduser()
if not path.is_absolute():
# Resolve relative paths against HERMES_HOME/scripts/
path = get_hermes_home() / "scripts" / path
scripts_dir = get_hermes_home() / "scripts"
path = (scripts_dir / path).resolve()
# Guard against path traversal (e.g. "../../etc/passwd")
try:
path.relative_to(scripts_dir.resolve())
except ValueError:
return False, f"Script path escapes the scripts directory: {script_path!r}"
else:
path = path.resolve()
# Restrict absolute paths to HERMES_HOME to prevent
# arbitrary file execution outside the user's data directory.
try:
path.relative_to(get_hermes_home().resolve())
except ValueError:
return False, f"Absolute script path must be inside HERMES_HOME: {script_path!r}"

if not path.exists():
return False, f"Script not found: {path}"
Expand All @@ -274,6 +288,13 @@ def _run_job_script(script_path: str) -> tuple[bool, str]:
parts.append(f"stdout:\n{stdout}")
return False, "\n".join(parts)

# Redact any secrets that may appear in script output before
# they are injected into the LLM prompt context.
try:
from agent.redact import redact_sensitive_text
stdout = redact_sensitive_text(stdout)
except Exception:
pass
return True, stdout

except subprocess.TimeoutExpired:
Expand Down
Loading