fix(security): quote HERMES_TIMEZONE in remote code execution to prevent shell injection

2026-04-12 03:06:53 +03:00
parent bef1d3e4ff
commit 84fcbbf6a9
2 changed files with 42 additions and 1 deletions
@@ -961,7 +961,7 @@ def _execute_remote(
        )
        tz = os.getenv("HERMES_TIMEZONE", "").strip()
        if tz:
-            env_prefix += f" TZ={tz}"
+            env_prefix += f" TZ={shlex.quote(tz)}"

        # Execute the script on the remote backend
        logger.info("Executing code on %s backend (task %s)...",