Mauricio Siu 6943a395fe fix(security): stop user-supplied schedule appName and escape its shell paths ...

drizzle-zod exposed appName (notNull + $defaultFn) as optional in the insert
schema, letting callers override it; it then flowed unquoted into rm -rf/mkdir
paths. Omit appName from createScheduleSchema and quote() the schedule fullPath
sinks (completes GHSA-fgh8 VULN-015 alongside the mount/patch fixes).

2026-07-20 17:07:32 -06:00

..

server

fix(security): stop user-supplied schedule appName and escape its shell paths

2026-07-20 17:07:32 -06:00