René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Security: Command injection via shell=True in git command execution (CWE-78)","articleBody":"## Summary\n\ncommitizen uses `subprocess.Popen(cmd, shell=True)` in `commitizen/cmd.py` to execute all git commands. Multiple functions in `commitizen/git.py` construct shell commands by interpolating values via f-strings without escaping.\n\n## Affected Code\n\n`commitizen/cmd.py` lines 41-43:\n```python\nprocess = subprocess.Popen(cmd, shell=True, ...)\n```\n\n`commitizen/git.py` line 173:\n```python\nreturn cmd.run(f'git tag {option} {tag} -m \"{msg or tag}\"')\n```\n\n`commitizen/git.py` line 167:\n```python\nreturn cmd.run(f\"git tag {tag}\")\n```\n\n`commitizen/git.py` line 177:\n```python\nreturn cmd.run(f\"git add {' '.join(args)}\")\n```\n\n## Attack Vector\n\nAn attacker poisons `pyproject.toml` (e.g., via PR) with:\n```toml\n[tool.commitizen]\nannotated_tag = true\nannotated_tag_message = 'Release\" \u0026\u0026 malicious_command \u0026\u0026 echo \"'\n```\n\nWhen CI/CD runs `cz bump`, the shell interprets the injected command.\n\n## Impact\n\n- Arbitrary command execution in CI/CD pipelines\n- CVSS 3.1: 7.8 (High)\n- Similar to CVE-2026-33718 (OpenHands command injection via git operations)\n\n## Suggested Fix\n\nReplace `shell=True` with list-based subprocess, or use `shlex.quote()`:\n```python\nsubprocess.run([\"git\", \"tag\", option, tag, \"-m\", msg or tag])\n```\n\n---\nReported by: Tom Chen (hypery11@gmail.com)","author":{"url":"https://github.com/hypery11","@type":"Person","name":"hypery11"},"datePublished":"2026-03-31T11:32:40.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":2},"url":"https://github.com/1918/commitizen/issues/1918"}