debuggerWindow.js:85,96 uses osascript with raw ${filePath} in double quotes.
escaping only handles single quotes, so a path with " or $(cmd) breaks out and executes arbitrary shell commands
OPENED THIS ISSUE FOR MYSELF so i don t forget to fix my own mess. will patch it when i can, thanks.
debuggerWindow.js:85,96usesosascriptwith raw${filePath}in double quotes.escaping only handles single quotes, so a path with
"or$(cmd)breaks out and executes arbitrary shell commandsOPENED THIS ISSUE FOR MYSELF so i don t forget to fix my own mess. will patch it when i can, thanks.