fix(core): prevent git option injection via CI branch names (GHSA-v58q-fvq4-9vh4)

[gregberge]

Description

Fixes GHSA-v58q-fvq4-9vh4 (CWE-88, argument injection) in @argos-ci/core.

The git helpers of the CI environment pass the branch and commit they get from CI to git as positional arguments. Git parses any argument starting with a dash as an option: a pull request opened from a branch named --upload-pack=<command> (a valid, pushable ref name) made git fetch run <command> through a shell on ssh:// and file:// origins, whenever the merge base is resolved locally (projects without a connected Git provider). The fix for GHSA-4x45-gxvp-6283 (#319) removed the shell but left this option parsing in place.

Changes

• Every git invocation receiving a CI-provided branch or commit now passes it after --end-of-options (git 2.24+, November 2019), so git always treats it as a ref: fetch, merge-base, rev-parse, log and rev-list.
• The fetch helper assembles the argument list itself (options, then --end-of-options origin, then refs), so no caller can leave the separator out.
• A note at the top of git.ts records both hardening rules with the advisory IDs.

Rejecting names starting with a dash was the alternative. The terminator was preferred because it keeps legitimately named branches working. On git older than 2.24 the commands fail on the unknown option before contacting the remote, so the failure is closed rather than exploitable.

Tests

The single shell-injection test is replaced with a block covering both advisories:

• three tests push the advisory's --upload-pack payload through the merge base, the ancestor listing and the commit parents, and assert the injected command never runs;
• one test pushes a branch named -dashed to origin and checks it is fetched and used as the merge-base head.

Against the unfixed code, the four new tests fail and the injected command runs from all three sinks. With the fix, the full @argos-ci/core suite passes (148 tests, 2 pre-existing skips), and tsc, eslint and prettier are clean.

Type of changes

bug

Checklist

• I have read the CONTRIBUTING doc
• The commits message follows the Conventional Commits' policy
• Lint and unit tests pass locally
• I have added tests if needed

Optional checks:

• My changes requires a change to the documentation
• I have updated the documentation accordingly

Further comments

Reported by @manus-use. Once merged, @argos-ci/core should be released and the new version set as the patched version on the advisory, which currently lists none.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
argos-js-sdk-reference	Ready	Preview	Sep 11, 2026 2:04pm UTC