feat: migrate opencode storage from JSON files to SQLite #62
grichaAnnotations
1 error
|
Command Injection in searchHostSessions via insufficient input sanitization:
src/agent/router.ts#L1309
User-controlled query string is inserted into shell command with inadequate escaping. Only quotes and backslashes are escaped, but shell metacharacters like $, `, ;, |, & remain unescaped, allowing arbitrary command execution via execSync.
|