@dotenvx/dotenvx 1.61.5 → 1.61.6

package/CHANGELOG.md

@@ -2,7 +2,13 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.61.5...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.61.6...main)
+
+## [1.61.6](https://github.com/dotenvx/dotenvx/compare/v1.61.5...v1.61.6) (2026-04-23)
+
+### Changed
+
+* Guard against command substitution following `encrypted:` ([#802](https://github.com/dotenvx/dotenvx/pull/802))
 
 ## [1.61.5](https://github.com/dotenvx/dotenvx/compare/v1.61.4...v1.61.5) (2026-04-22)
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.61.5",
+  "version": "1.61.6",
   "name": "@dotenvx/dotenvx",
   "description": "secrets for agents–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/lib/helpers/executeExtension.js

@@ -23,7 +23,7 @@ function executeExtension (ext, command, rawArgs) {
   const result = childProcess.spawnSync(`dotenvx-ext-${command}`, forwardedArgs, { stdio: 'inherit', env })
   if (result.error) {
     // list known extension here for convenience to the user
-    if (['vault', 'hub'].includes(command)) {
+    if (['vault'].includes(command)) {
       logger.warn(`[INSTALLATION_NEEDED] install dotenvx-ext-${command} to use [dotenvx ext ${command}] commands`)
       logger.help('? see installation instructions [https://github.com/dotenvx/dotenvx-ext-vault]')
     } else {

package/src/lib/helpers/parse.js

@@ -1,4 +1,5 @@
 const decryptKeyValue = require('./cryptography/decryptKeyValue')
+const isEncrypted = require('./cryptography/isEncrypted')
 const evalKeyValue = require('./evalKeyValue')
 const resolveEscapeSequences = require('./resolveEscapeSequences')
 
@@ -44,9 +45,11 @@ class Parse {
         this.errors.push(e)
       }
 
+      const encryptedPrefixed = isEncrypted(this.parsed[key]) // do not eval encrypted prefix
+
       // eval empty, double, or backticks
       let evaled = false
-      if (quote !== "'" && (!this.inProcessEnv(key) || this.processEnv[key] === this.parsed[key])) {
+      if (!encryptedPrefixed && quote !== "'" && (!this.inProcessEnv(key) || this.processEnv[key] === this.parsed[key])) {
         const priorEvaled = this.parsed[key]
         // eval
         try {
@@ -60,7 +63,7 @@ class Parse {
       }
 
       // expand empty, double, or backticks
-      if (!evaled && quote !== "'" && (!this.processEnv[key] || this.overload)) {
+      if (!encryptedPrefixed && !evaled && quote !== "'" && (!this.processEnv[key] || this.overload)) {
         this.parsed[key] = resolveEscapeSequences(this.expand(this.parsed[key]))
       }
 

package/src/lib/main.js

@@ -103,7 +103,7 @@ const config = function (options = {}) {
       }
     }
 
-    let msg = `injecting env (${uniqueInjectedKeys.length})`
+    let msg = `injected env (${uniqueInjectedKeys.length})`
     if (readableFilepaths.length > 0) {
       msg += ` from ${readableFilepaths.join(', ')}`
     }