fix(security): mosaic-init RCE — eval on prompt answers → printf -v (#1115) #1127

Open

mos-dt-0 wants to merge 1 commits from fix/mosaic-init-rce into next

pull from: fix/mosaic-init-rce

merge into: :next

:main

:next

:feat/1150-pi-goal-extension

:feat/webui-p3-chat

:fix/1146-ci-queue-purpose

:docs/webui-phase-p-structure

:fix/1138-conditional-federation

:feat/webui-p2-data-auth

:fix/gateway-runner-image

:feat/webui-p1-vite-skeleton

:fix/break-c-hooks-and-web-image

:docs/webui-fleet-claude-bridge-plan

:fix/wizard-gateway-failure

:fix/ci-queue-wait-no-status

:fix/next-node-gate

:fix/mosaic-init-rce

:feat/lease-promotion-and-harness-isolation

:greenfield/fomo-lin

:fix/1099-pipefail-wake

:fix/1099-pipefail-tests

:fix/1099-pipefail-sweep

:fix/framework-shell-portability

:fix/1043-pane-git-identity

:fix/1081-issue-close-silent-comment-failure

:fix/1090-enrollment-wallclock-tolerance

:feat/1082-tea-stale-token-diagnostic

:fix/detect-platform-silent-128-outside-repo

:feat/1050-install-state-machine-red-fixture

:fix/pr-merge-message-field

:feat/1051-mosaic-brain-installer

:feat/1045-mosaic-cred

:remediation/state

:fix/1056-upgrade-rollback-control-race

:fix/1019-ci-queue-timeout-harness

:feat/rm-02-gate-registry

:fix/rm-01-reproducible-checkout

:remediation/mission-setup

:fix/hygiene-inert-format-gate

:fix/1019-queue-guard-stdin

:feat/mos-ste-writing-standard

:fix/1007-suite-hermeticity

:fix/991-comment-url-scheme-normalise

:feat/push-guard-null-case-verification

:mos-comms-live

:docs/heartbeat-framework-layering-ms-lead

:feat/869-c4-version-coupling

:feat/869-c2-install-ordering-guard

:feat/869-c5-doctor-activation-check

:feat/per-agent-gitea-identity

:fix/875-belongs-case-insensitive-slug

:fix/ci-queue-wait-404-branch-absent

:feat/869-c1-activation-probe

:feat/869-c3-broker-supervisor

:fix/865-tea-cli-comment-invocation

:feat/glpi-skills

:fix/860-deflake-mutator-lease-gate

:fix/850-detect-platform-port-normalization

:fix/856-worktree-deps-preflight

:fix/835-pr-review-approve-reject-comment-flag

:fix/848-truthful-evidence

:fix/812-pr-review-comment

:fix/849-recovery-runtime-fixture-race

:docs/758-ledger-m5-001-sync

:feat/834-tc-server-side-doc

:feat/833-constrained-recovery-command

:feat/827-gate0-probe

:governance/gate0-probe3-amendment

:fix/795-codex-pr-diff

:fix/795-ci-base-jq

:fix/795-ci-base-git

:feat/791-pr3-fleet-regen

:feat/791-pr2-snapshot-restore

:fix/807-glpi-206

:fix/808-agent-send-false-sender

:feat/791-upgrade-config-protection

:feat/790-mosaic-yolo-claudex-pr2

:feat/790-mosaic-yolo-claudex

:feat/758-v1-v2-migrator

:fix/766-exact-fleet-comms

:test/758-reconciler-lifecycle-gates

:docs/771-kbn101-db-role-split

:test/758-example-profile-dispositions

:feat/758-shared-role-resolution

:feat/mos-logical-identity-fencing

:feat/769-kbn100-unified-schema

:docs/753-kbn010-threat-gate

:feat/758-roster-v2-compiler

:feat/756-official-discord-plugin

:docs/758-fleet-config-management

:fix/mos-option2-qualification-format

:docs/issue-758-m0

:docs/mos-option2-qualification

:mos-comms

:feat/tess-interaction-agent

:fix/tess-docs-format

:draft/mosaic-platform-prd

:fix/installer-provider-gate-and-local-gateway-redis

:release/mosaic-cli-0.0.37

:feat/framework-constitution-alpha

:fix/git-wrapper-repo-detection

:fix/woodpecker-wrapper-legacy-mosaic

:fix/t-a292e96f-gitea-pr-metadata

:fix/gitea-pr-metadata-login-t-a292e96f

:fix/t_a292e96f-pr-metadata-gitea

:fix/t_3a368a52-gitea-usc-login

:fix/bootstrap-hotfix

:fix/populate-known-packages-list

:fix/idempotent-init

Conversation 0 Commits 1 Files Changed 3

+26 -5

1 Commits

Author	SHA1	Message	Date
Jason Woltje	12677a928d	fix(mosaic): prevent init prompt code execution	2026-08-09 00:28:57 -05:00