blitzstrike 2.4.19 → 2.4.20

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.20] — 2026-09-14
+
+### Security — command-injection fixes (self-audit)
+
+- CRITICAL: `run_catalog_tool` built a shell string (`args.join(" ")` + `shell: true`)
+  from the target — an attacker-controlled target with shell metacharacters
+  (`evil.com; rm -rf /`) executed arbitrary commands. Now runs the tool directly
+  (`spawnSync(args[0], args.slice(1))`, no shell) — the target is a literal argv.
+- MEDIUM: `diff_analyze` / `incremental_scan` / `worktree` interpolated
+  user-controlled git refs + branch/path into `execSync` (shell). Now use
+  `execFileSync("git", [...])` — no shell interpretation.
+
 ## [2.4.19] — 2026-09-14
 
 ### Added — unit tests for 5 deep modules + off-by-one fix

package/dist/index.js

@@ -7635,7 +7635,7 @@ function runCatalogTool(hint, target, extraFlags = []) {
     };
   }
   const args = buildCatalogCommand(t, target, extraFlags);
-  const r = spawnSync(args.join(" "), { shell: true, timeout: 90000, maxBuffer: 1024 * 1024 });
+  const r = spawnSync(args[0], args.slice(1), { timeout: 90000, maxBuffer: 1024 * 1024 });
   const out = (r.stdout?.toString() ?? "") || (r.stderr?.toString() ?? "");
   return {
     found: true,
@@ -15643,7 +15643,7 @@ var init_update = __esm(() => {
 import { readFileSync as readFileSync20, existsSync as existsSync10 } from "node:fs";
 import { join as join17 } from "node:path";
 import { fileURLToPath as fileURLToPath10 } from "node:url";
-import { execSync as execSync4 } from "node:child_process";
+import { execSync as execSync2 } from "node:child_process";
 function validateRelease() {
   const checks = [];
   checks.push({ name: "package.json version", ok: true, detail: VERSION });
@@ -15660,13 +15660,13 @@ function validateRelease() {
     checks.push({ name: "CHANGELOG version", ok: false, detail: "CHANGELOG.md not found" });
   }
   try {
-    const tag = execSync4("git describe --tags --abbrev=0", { cwd: ROOT8, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    const tag = execSync2("git describe --tags --abbrev=0", { cwd: ROOT8, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
     checks.push({ name: "Git tag", ok: tag === `v${VERSION}`, detail: tag, soft: true });
   } catch {
     checks.push({ name: "Git tag", ok: true, detail: "unavailable (no git/tags)", soft: true });
   }
   try {
-    const published = execSync4("npm view blitzstrike version", { encoding: "utf8", timeout: 8000, stdio: ["ignore", "pipe", "ignore"] }).trim();
+    const published = execSync2("npm view blitzstrike version", { encoding: "utf8", timeout: 8000, stdio: ["ignore", "pipe", "ignore"] }).trim();
     checks.push({ name: "npm registry version", ok: published === VERSION, detail: published, soft: true });
   } catch {
     checks.push({ name: "npm registry version", ok: true, detail: "unavailable (offline)", soft: true });
@@ -34761,7 +34761,7 @@ async function runAutonomous(target, scope = "", mode = "bug-bounty", maxPasses
 }
 
 // src/ops.ts
-import { execSync } from "node:child_process";
+import { execSync, execFileSync } from "node:child_process";
 function decomposeBatches(tasks) {
   const remaining = [...tasks];
   const done = new Set;
@@ -34806,13 +34806,13 @@ function worktree(action, path, branch) {
       if (!path)
         return { action, ok: false, error: "path is required for worktree add" };
       const b = branch ?? `blitz-${Date.now().toString(36)}`;
-      const out = execSync(`git worktree add -b ${b} "${path}"`, { encoding: "utf8" }).trim();
+      const out = execFileSync("git", ["worktree", "add", "-b", b, path], { encoding: "utf8" }).trim();
       return { action, ok: true, branch: b, path, out };
     }
     if (action === "remove") {
       if (!path)
         return { action, ok: false, error: "path is required for worktree remove" };
-      execSync(`git worktree remove "${path}" --force`, { encoding: "utf8" });
+      execFileSync("git", ["worktree", "remove", path, "--force"], { encoding: "utf8" });
       return { action, ok: true, path };
     }
     return { action, ok: false, error: "unknown action (use add | list | remove)" };
@@ -35160,7 +35160,7 @@ function engagementStatus() {
 }
 
 // src/incremental.ts
-import { execSync as execSync2 } from "node:child_process";
+import { execFileSync as execFileSync2 } from "node:child_process";
 import { writeFileSync as writeFileSync3, mkdtempSync, rmSync } from "node:fs";
 import { join as join11 } from "node:path";
 import { tmpdir } from "node:os";
@@ -54662,7 +54662,7 @@ registerLanguage(javaAdapter);
 var SOURCE_EXTS = [".php", ".phtml", ".js", ".mjs", ".ts", ".tsx", ".py", ".pyw", ".java"];
 function git(repo, args) {
   try {
-    return execSync2(`git ${args}`, { cwd: repo, encoding: "utf8", maxBuffer: 50 * 1024 * 1024 }).trim();
+    return execFileSync2("git", args.split(/\s+/).filter(Boolean), { cwd: repo, encoding: "utf8", maxBuffer: 50 * 1024 * 1024 }).trim();
   } catch {
     return "";
   }
@@ -55094,7 +55094,7 @@ function taintTree(root, maxFiles = 2000) {
 import { writeFileSync as writeFileSync4, rmSync as rmSync2, mkdtempSync as mkdtempSync2, readFileSync as readFileSync14 } from "node:fs";
 import { join as join12 } from "node:path";
 import { tmpdir as tmpdir2 } from "node:os";
-import { execSync as execSync3 } from "node:child_process";
+import { execFileSync as execFileSync3 } from "node:child_process";
 init_scanner();
 function runEngine(code, language, file) {
   if (language === "php") {
@@ -55262,7 +55262,7 @@ var SOURCE_EXTS2 = [".php", ".phtml", ".php5", ".js", ".mjs", ".ts", ".tsx", ".p
 function analyzeGitDiff(repo, base = "HEAD~1", head = "HEAD") {
   const git = (args) => {
     try {
-      return execSync3(`git ${args}`, { cwd: repo, encoding: "utf8", maxBuffer: 50 * 1024 * 1024 }).trim();
+      return execFileSync3("git", args.split(/\s+/).filter(Boolean), { cwd: repo, encoding: "utf8", maxBuffer: 50 * 1024 * 1024 }).trim();
     } catch {
       return "";
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.19",
+  "version": "2.4.20",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {