v1.4.461

nari-labs/dia2v1.4.461Jul 28, 2026by github-actions[bot]

AI Summary

This is a security patch release that fixes a command injection vulnerability in the extension executor by shell-escaping user-controlled values.

Key Highlights

Security Fix: Shell-escaped extension values to prevent command injection
Fixed execution via sh -c with unescaped user-controlled values
Wrapped values in single quotes with embedded-single-quote escaping
Added regression test (ShellInjectionBlocked) to verify protection

Full Release Notes

## Changes

### PR [#2152](https://github.com/danielmiessler/Fabric/pull/2152) by [AUTHENSOR](https://github.com/AUTHENSOR): fix: shell-escape extension values to prevent command injection

- **Fix:** Shell-escape extension values to prevent command injection in the extension executor, which previously ran commands via `sh -c` with unescaped, user-controlled values interpolated into the command string. All user-controlled values are now wrapped in single quotes with embedded-single-quote escaping prior to interpolation, ensuring the shell treats them as literal arguments. A regression test (`ShellInjectionBlocked`) has been added to verify that malicious input (e.g., `hello; touch /marker`) does not execute unintended shell commands.