AIKIDO-2026-10690

TL;DR

Browser and desktop helpers that opened dashboards or vendor links still routed user-influenced strings through a shell-backed exec helper, so metacharacters could pivot into host command execution when those code paths ran. Configuration merge helpers treated attacker-controlled keys like ordinary fields, so prototype-chain keys could poison shared objects during set and unset. The HTTP interface path that strips sensitive environment variables for child processes could skip work entirely under some control flows, leaking more of the parent environment than intended. The major release switches those opens to execFile with fixed argument lists and tighter SUDO_USER handling, rejects dangerous prototype keys, and corrects env stripping.