From 49e3ff46e4cfcb7cb94856fc9b6b1b5dc113095d Mon Sep 17 00:00:00 2001 From: Anupam Mediratta Date: Fri, 31 Jul 2026 20:46:55 +0530 Subject: [PATCH] fix: sanitize shell/subprocess call in linux.rs (#10748) --- crates/goose-mcp/src/computercontroller/platform/linux.rs | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/crates/goose-mcp/src/computercontroller/platform/linux.rs b/crates/goose-mcp/src/computercontroller/platform/linux.rs index 4732993d3..bb1d825c7 100644 --- a/crates/goose-mcp/src/computercontroller/platform/linux.rs +++ b/crates/goose-mcp/src/computercontroller/platform/linux.rs @@ -180,13 +180,14 @@ impl LinuxAutomation { let mut script = String::from( r#"#!/usr/bin/env python3 import subprocess +import shlex import os import sys import time def run_command(cmd): try: - result = subprocess.run(cmd, shell=True, capture_output=True, text=True) + result = subprocess.run(shlex.split(cmd), shell=False, capture_output=True, text=True) return result.stdout except Exception as e: print(f"Error executing {cmd}: {e}", file=sys.stderr) @@ -196,7 +197,8 @@ def run_command(cmd): ); for cmd in commands { - script.push_str(&format!("run_command('{}')\n", cmd)); + let escaped = cmd.replace('\\', "\\\\").replace('\'', "\\'"); + script.push_str(&format!("run_command('{}')\n", escaped)); } script