AIKIDO-2026-648841

TL;DR

The run_evaluation_tests tool builds a CircleCI pipeline configuration from caller-supplied input and submits it to the CircleCI API for execution. The promptFiles[].fileName value is accepted as an unconstrained string and interpolated unquoted into shell commands inside the generated config, so a caller who controls fileName can inject arbitrary shell that runs in the CircleCI job under the server's CircleCI token. In the documented shared-token remote deployment mode the server requires no authentication, so an unauthenticated network client can reach the sink and gain command execution with the token's full CI/CD access. The fix constrains fileName to a strict character allowlist at the schema boundary, single-quotes it at every interpolation site, and makes remote request authentication required by default.