[sighthound] Security findings in github/gh-aw

[github-actions]

Sighthound identified 141 total findings (141 actionable outside test paths). The top 5 by severity are all Critical Command Injection (CWE-78):

#	File	Line	Context	Severity
1	pkg/cli/runner_guard.go	94	runRunnerGuardOnDirectory	Critical
2	pkg/cli/grant.go	156	grantRunOnImage	Critical
3	pkg/cli/poutine.go	201	runPoutineOnFile	Critical
4	pkg/cli/poutine.go	100	runPoutineOnDirectory	Critical
5	pkg/cli/upgrade_command.go	496	relaunchWithSameArgs	Critical

Description

All five findings involve exec.Command(...) being called with arguments derived from dynamic/untrusted data (form data, user inputs, or dynamic execution paths), flagged as potential OS command injection (CWE-78).

Remediation

1. runner_guard.go:94 — containerScanPath and volumeMount are built from user-controlled input. Validate and sanitize paths strictly; ensure no shell metacharacters; prefer absolute path allowlists.
2. grant.go:156 — imageRef and policyFile originate from dynamic execution. Validate imageRef against an allowlist/regex; sanitize policyFile path before passing as a volume mount argument.
3. poutine.go:201 & poutine.go:100 — gitRoot is passed directly as a volume mount path. Validate it is an absolute, canonical path within expected bounds before use.
4. upgrade_command.go:496 — exe and newArgs are derived from dynamic execution context. Ensure exe is a fully-resolved, trusted binary path and newArgs are validated before re-launch.

General guidance: Never concatenate user-controlled input into command arguments. Always pass arguments as a fixed, validated slice. Use filepath.Clean and path validation helpers to sanitize file paths before use in exec.Command.

Generated by 🛡️ Sighthound Security Scan · sonnet46 · 17.3 AIC · ⌖ 5.62 AIC · ⊞ 5.4K · ◷

[github-actions]

This issue is being closed as outdated. A newer issue has been created: #48538

View newer issue

---

This action was performed automatically by the Sighthound Security Scan workflow.