blitzstrike 2.4.20 → 2.4.21

package/CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.21] — 2026-09-14
+
+### Security — eliminate the last shell-interpolation sites
+
+- `hasCommand` (catalog) + `which` (cli) checked `command -v ${cmd}` with
+  `shell: true`. Hardened: the command is now passed as a positional `$1` to
+  `sh -c 'command -v "$1"'` — zero user-controlled shell text anywhere.
+- Full re-audit: 0 remaining `shell: true` + dynamic/interpolated argument.
+  The 8 remaining `shell: true` calls all run STATIC, trusted commands
+  (catalog install/check strings), never user input.
+
 ## [2.4.20] — 2026-09-14
 
 ### Security — command-injection fixes (self-audit)

package/dist/index.js

@@ -7414,7 +7414,7 @@ function provisionMissingToolchains() {
   return missing;
 }
 function hasCommand(cmd) {
-  return spawnSync(`command -v ${cmd}`, { shell: true, timeout: 8000 }).status === 0;
+  return spawnSync("sh", ["-c", 'command -v "$1" >/dev/null 2>&1', "sh", cmd], { timeout: 8000 }).status === 0;
 }
 function requiredToolchain(cmd) {
   if (/^\s*go\s+install\b/.test(cmd))
@@ -15728,7 +15728,7 @@ import { homedir as homedir7 } from "node:os";
 import { fileURLToPath as fileURLToPath12 } from "node:url";
 import { spawnSync as spawnSync5 } from "node:child_process";
 function which(cmd) {
-  return spawnSync5(`command -v ${cmd}`, { shell: true }).status === 0;
+  return spawnSync5("sh", ["-c", 'command -v "$1" >/dev/null 2>&1', "sh", cmd]).status === 0;
 }
 function installedCount() {
   const tools = loadTools();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.20",
+  "version": "2.4.21",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {