From 18a473200574358f7f984eac66445b9541f996c9 Mon Sep 17 00:00:00 2001
From: TrueAlpha-spiral <199723968+TrueAlpha-spiral@users.noreply.github.com>
Date: Sat, 25 Apr 2026 19:09:46 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=20Fix=20command=20injection=20in?=
 =?UTF-8?q?=20Sandbox=20proxy=20teardown?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
---
 packages/cli/src/utils/sandbox.security.test.ts |  1 +
 packages/cli/src/utils/sandbox.ts               | 10 ++++++++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/packages/cli/src/utils/sandbox.security.test.ts b/packages/cli/src/utils/sandbox.security.test.ts
index 45a41d3586e..c50d9c59ea6 100644
--- a/packages/cli/src/utils/sandbox.security.test.ts
+++ b/packages/cli/src/utils/sandbox.security.test.ts
@@ -11,6 +11,7 @@ vi.mock('node:child_process', () => {
     spawn: vi.fn(),
     exec: vi.fn(),
     execSync: vi.fn(),
+  execFileSync: vi.fn(),
   };
   return {
     ...mockCp,
diff --git a/packages/cli/src/utils/sandbox.ts b/packages/cli/src/utils/sandbox.ts
index 95f23d82075..d39e1ea0613 100644
--- a/packages/cli/src/utils/sandbox.ts
+++ b/packages/cli/src/utils/sandbox.ts
@@ -4,7 +4,13 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { exec, execSync, spawn, type ChildProcess } from 'node:child_process';
+import {
+  exec,
+  execSync,
+  execFileSync,
+  spawn,
+  type ChildProcess,
+} from 'node:child_process';
 import os from 'node:os';
 import path from 'node:path';
 import fs from 'node:fs';
@@ -784,7 +790,7 @@ export async function start_sandbox(
       // install handlers to stop proxy on exit/signal
       const stopProxy = () => {
         console.log('stopping proxy container ...');
-        execSync(`${config.command} rm -f ${SANDBOX_PROXY_NAME}`);
+        execFileSync(config.command, ['rm', '-f', SANDBOX_PROXY_NAME]);
       };
       process.on('exit', stopProxy);
       process.on('SIGINT', stopProxy);