From 3516f59d3e3e935ffa4c24a623e5bce9e2b2e13d Mon Sep 17 00:00:00 2001
From: Fernando Celmer <email@fernandocelmer.com>
Date: Sat, 15 Aug 2026 01:00:57 -0300
Subject: [PATCH] =?UTF-8?q?=E2=9A=A0=EF=B8=8F=20SECURITY-#6:=20Use=20execF?=
 =?UTF-8?q?ile=20instead=20of=20shell-interpolated=20exec=20for=20hasCli/c?=
 =?UTF-8?q?heckCliVersion?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/features/chat/chat.controller.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/features/chat/chat.controller.ts b/src/features/chat/chat.controller.ts
index fa365d7..4a61990 100644
--- a/src/features/chat/chat.controller.ts
+++ b/src/features/chat/chat.controller.ts
@@ -45,14 +45,14 @@ export class ChatController {
   async hasCli(): Promise<boolean> {
     const command = this.resolveSetting(readSettings().command);
     return new Promise((resolve) => {
-      cp.exec(`"${command}" --help`, (error) => resolve(!error));
+      cp.execFile(command, ["--help"], { timeout: 5000 }, (error) => resolve(!error));
     });
   }
 
   async checkCliVersion(): Promise<void> {
     const command = this.resolveSetting(readSettings().command);
     const current = await new Promise<string | null>((resolve) => {
-      cp.exec(`"${command}" --version`, (error, stdout) => {
+      cp.execFile(command, ["--version"], { timeout: 5000 }, (error, stdout) => {
         resolve(error ? null : parseVersionOutput(stdout));
       });
     });