ci: guard against shell injection

[birkskyum]

CI vulnerability surfaced by code rabbit:

• ci: align publishing to router with main/-pre/-maint query#10283 (comment)

Prevent shell injection by passing repository paths as command arguments.

relPath comes from filesystem glob results and can contain shell metacharacters. When interpolated into the execSync command string, a maliciously named package directory (e.g., query$(whoami)/package.json) would execute arbitrary commands during the release workflow. Use execFileSync with an argument array to bypass shell interpretation.

Summary by CodeRabbit

• Chores
  • Updated internal release automation to improve reliability and efficiency of the release creation process.

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 35ce7a3

Command	Status	Duration	Result
nx affected --targets=test:eslint,test:unit,tes...	✅ Succeeded	<1s	View ↗
nx run-many --target=build --exclude=examples/*...	✅ Succeeded	1s	View ↗

---

☁️ Nx Cloud last updated this comment at 2026-03-18 00:44:35 UTC

[github-actions]

🚀 Changeset Version Preview

No changeset entries found. Merging this PR will not cause a version bump for any packages.

[pkg-pr-new]

More templates

• tanstack-router-react-example-authenticated-routes
• tanstack-router-react-example-authenticated-routes-firebase
• tanstack-router-react-example-basic
• tanstack-router-react-example-basic-default-search-params
• tanstack-router-react-example-basic-devtools-panel
• tanstack-router-react-example-basic-file-based
• tanstack-router-react-example-basic-non-nested-devtools
• tanstack-router-react-example-react-query
• tanstack-router-react-example-basic-react-query-file-based
• tanstack-router-react-example-basic-ssr-file-based
• tanstack-router-react-example-basic-ssr-streaming-file-based
• tanstack-router-react-example-basic-virtual-file-based
• tanstack-router-react-example-basic-virtual-inside-file-based
• tanstack-router-react-example-deferred-data
• tanstack-router-i18n-paraglide
• tanstack-router-react-example-kitchen-sink
• tanstack-router-react-example-kitchen-sink-file-based
• tanstack-router-react-example-kitchen-sink-react-query
• tanstack-router-react-example-kitchen-sink-react-query-file-based
• tanstack-router-react-example-large-file-based
• tanstack-router-react-example-location-masking
• tanstack-router-react-example-navigation-blocking
• tanstack-router-react-example-quickstart
• tanstack-router-react-example-quickstart-esbuild-file-based
• tanstack-router-react-example-quickstart-file-based
• tanstack-router-react-example-quickstart-rspack-file-based
• tanstack-router-react-example-quickstart-webpack-file-based
• router-monorepo-react-query
• router-mono-simple
• router-mono-simple-lazy
• tanstack-router-react-example-scroll-restoration
• tanstack-search-validator-adapters
• tanstack-start-example-bare
• tanstack-start-example-basic
• tanstack-start-example-basic-auth
• tanstack-router-react-example-basic-authjs
• tanstack-start-example-basic-cloudflare
• tanstack-start-example-basic-react-query
• tanstack-start-example-basic-rsc
• tanstack-start-example-basic-static
• tanstack-start-bun-hosting
• tanstack-start-example-clerk-basic
• tanstack-start-example-convex-trellaux
• tanstack-start-example-counter
• tanstack-start-i18n-paraglide
• tanstack-start-example-large
• tanstack-start-example-material-ui
• tanstack-start-streaming-data-from-server-functions
• tanstack-start-example-supabase-basic
• tanstack-start-tailwind-v4
• tanstack-start-example-trellaux
• tanstack-start-example-workos
• tanstack-router-react-example-view-transitions
• tanstack-router-react-example-with-framer-motion
• tanstack-router-react-example-with-trpc
• tanstack-router-react-example-with-trpc-react-query
• tanstack-router-solid-example-authenticated-routes
• tanstack-router-solid-example-authenticated-routes-firebase
• tanstack-router-solid-example-basic
• tanstack-router-solid-example-basic-default-search-params
• tanstack-router-solid-example-basic-devtools-panel
• tanstack-router-solid-example-basic-file-based
• tanstack-router-solid-example-basic-non-nested-devtools
• tanstack-router-solid-example-basic-solid-query
• tanstack-router-solid-example-basic-solid-query-file-based
• tanstack-router-solid-example-basic-ssr-file-based
• tanstack-router-solid-example-basic-ssr-streaming-file-based
• tanstack-router-solid-example-basic-virtual-file-based
• tanstack-router-solid-example-basic-virtual-inside-file-based
• tanstack-router-solid-example-deferred-data
• tanstack-router-solid-i18n-paraglide
• tanstack-router-solid-example-kitchen-sink
• tanstack-router-solid-example-kitchen-sink-file-based
• tanstack-router-solid-example-kitchen-sink-solid-query
• tanstack-router-solid-example-kitchen-sink-solid-query-file-based
• tanstack-router-solid-example-large-file-based
• tanstack-router-solid-example-location-masking
• tanstack-router-solid-example-navigation-blocking
• tanstack-router-solid-example-quickstart
• tanstack-router-solid-example-quickstart-esbuild-file-based
• tanstack-router-solid-example-quickstart-file-based
• tanstack-router-solid-example-quickstart-rspack-file-based
• tanstack-router-solid-example-quickstart-webpack-file-based
• @tanstack/router-solid-mono-simple
• router-solid-mono-simple-lazy
• router-solid-monorepo-solid-query
• tanstack-router-solid-example-scroll-restoration
• tanstack-solid-router-search-validator-adapters
• tanstack-solid-start-example-basic
• tanstack-solid-start-example-basic-auth
• tanstack-solid-start-example-basic-authjs
• tanstack-solid-start-example-basic-cloudflare
• tanstack-solid-start-example-basic-netlify
• tanstack-solid-start-example-basic-nitro
• tanstack-start-example-basic-solid-query
• tanstack-solid-start-example-basic-static
• tanstack-solid-start-bun-hosting
• tanstack-solid-start-example-convex-better-auth
• tanstack-solid-start-example-counter
• tanstack-solid-start-i18n-paraglide
• tanstack-solid-start-example-large
• tanstack-solid-start-streaming-data-from-server-functions
• tanstack-solid-start-example-supabase-basic
• tanstack-solid-start-tailwind-v4
• tanstack-router-solid-example-view-transitions
• tanstack-router-solid-example-with-framer-motion
• tanstack-router-solid-example-with-trpc
• tanstack-router-vue-example-basic-jsx
• tanstack-router-vue-example-basic-file-based-jsx
• tanstack-router-vue-example-basic-file-based-sfc

@tanstack/arktype-adapter

npm i https://pkg.pr.new/@tanstack/arktype-adapter@6965

@tanstack/eslint-plugin-router

npm i https://pkg.pr.new/@tanstack/eslint-plugin-router@6965

@tanstack/history

npm i https://pkg.pr.new/@tanstack/history@6965

@tanstack/nitro-v2-vite-plugin

npm i https://pkg.pr.new/@tanstack/nitro-v2-vite-plugin@6965

@tanstack/react-router

npm i https://pkg.pr.new/@tanstack/react-router@6965

@tanstack/react-router-devtools

npm i https://pkg.pr.new/@tanstack/react-router-devtools@6965

@tanstack/react-router-ssr-query

npm i https://pkg.pr.new/@tanstack/react-router-ssr-query@6965

@tanstack/react-start

npm i https://pkg.pr.new/@tanstack/react-start@6965

@tanstack/react-start-client

npm i https://pkg.pr.new/@tanstack/react-start-client@6965

@tanstack/react-start-server

npm i https://pkg.pr.new/@tanstack/react-start-server@6965

@tanstack/router-cli

npm i https://pkg.pr.new/@tanstack/router-cli@6965

@tanstack/router-core

npm i https://pkg.pr.new/@tanstack/router-core@6965

@tanstack/router-devtools

npm i https://pkg.pr.new/@tanstack/router-devtools@6965

@tanstack/router-devtools-core

npm i https://pkg.pr.new/@tanstack/router-devtools-core@6965

@tanstack/router-generator

npm i https://pkg.pr.new/@tanstack/router-generator@6965

@tanstack/router-plugin

npm i https://pkg.pr.new/@tanstack/router-plugin@6965

@tanstack/router-ssr-query-core

npm i https://pkg.pr.new/@tanstack/router-ssr-query-core@6965

@tanstack/router-utils

npm i https://pkg.pr.new/@tanstack/router-utils@6965

@tanstack/router-vite-plugin

npm i https://pkg.pr.new/@tanstack/router-vite-plugin@6965

@tanstack/solid-router

npm i https://pkg.pr.new/@tanstack/solid-router@6965

@tanstack/solid-router-devtools

npm i https://pkg.pr.new/@tanstack/solid-router-devtools@6965

@tanstack/solid-router-ssr-query

npm i https://pkg.pr.new/@tanstack/solid-router-ssr-query@6965

@tanstack/solid-start

npm i https://pkg.pr.new/@tanstack/solid-start@6965

@tanstack/solid-start-client

npm i https://pkg.pr.new/@tanstack/solid-start-client@6965

@tanstack/solid-start-server

npm i https://pkg.pr.new/@tanstack/solid-start-server@6965

@tanstack/start-client-core

npm i https://pkg.pr.new/@tanstack/start-client-core@6965

@tanstack/start-fn-stubs

npm i https://pkg.pr.new/@tanstack/start-fn-stubs@6965

@tanstack/start-plugin-core

npm i https://pkg.pr.new/@tanstack/start-plugin-core@6965

@tanstack/start-server-core

npm i https://pkg.pr.new/@tanstack/start-server-core@6965

@tanstack/start-static-server-functions

npm i https://pkg.pr.new/@tanstack/start-static-server-functions@6965

@tanstack/start-storage-context

npm i https://pkg.pr.new/@tanstack/start-storage-context@6965

@tanstack/valibot-adapter

npm i https://pkg.pr.new/@tanstack/valibot-adapter@6965

@tanstack/virtual-file-routes

npm i https://pkg.pr.new/@tanstack/virtual-file-routes@6965

@tanstack/vue-router

npm i https://pkg.pr.new/@tanstack/vue-router@6965

@tanstack/vue-router-devtools

npm i https://pkg.pr.new/@tanstack/vue-router-devtools@6965

@tanstack/vue-router-ssr-query

npm i https://pkg.pr.new/@tanstack/vue-router-ssr-query@6965

@tanstack/vue-start

npm i https://pkg.pr.new/@tanstack/vue-start@6965

@tanstack/vue-start-client

npm i https://pkg.pr.new/@tanstack/vue-start-client@6965

@tanstack/vue-start-server

npm i https://pkg.pr.new/@tanstack/vue-start-server@6965

@tanstack/zod-adapter

npm i https://pkg.pr.new/@tanstack/zod-adapter@6965

commit: 35ce7a3

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 14fc884f-19ee-45f8-837e-793732adafd9

📥 Commits

Reviewing files that changed from the base of the PR and between 3a32ad6 and 35ce7a3.

📒 Files selected for processing (1)

• scripts/create-github-release.mjs

---

📝 Walkthrough

Walkthrough

The script scripts/create-github-release.mjs is updated to use execFileSync instead of execSync for executing a git command. The import statement is modified to include execFileSync from node:child_process, and the git show invocation is refactored from a concatenated string format to an argument array format with explicit encoding and stdio configuration.

Changes

Cohort / File(s)	Summary
Git Command Execution Refactoring scripts/create-github-release.mjs	Updated import to include execFileSync alongside execSync. Replaced execSync(\git show ...`)string invocation withexecFileSync('git', ['show', ...], { encoding: 'utf-8', stdio: [...] })` for safer argument passing and explicit stream handling.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 A hop, skip, and refactor so fine,
From strings to arrays, the code does align,
Exec to ExecFile, a safer way to go,
Git commands now flow with a cleaner show! 🌟

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci--guard-against-shell-injection

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}