3 ms·

This is exactly why Unix PATH (and offspring) does not contain "." by default. If you unpack an untrusted archive and run "ls" you could get popped. Agents sho

by imglorp 3mo ago

This is exactly why Unix PATH (and offspring) does not contain "." by default. If you unpack an untrusted archive and run "ls" you could get popped. Agents should be no different.

nickelpro 3mo ago
They aren't. This is a Windows quirk. Most IDE extensions which interface with git (or any other CLI program) from the CWD are "vulnerable" to the same attack. This is why the upstream didn't take it seriously, this has been known for literal decades.