Mage Git project API passed untrusted parameters into shell commands

Mage AI's affected repository management API reconstructed user-influenced paths, messages and Git parameters into shell command strings. Once a caller reached those endpoints, shell syntax could be interpreted as executable instructions rather than literal repository data. That route matters in an AI-capable coding environment because automated workflows may supply unusual file names or instructions, but the vulnerability itself is a server-side command-construction defect.

Maintainer PR #6205, merged on October 16, replaces affected command construction with argument-vector execution, literal path arguments and -- delimiters. It restricts generic Git commands to reviewed read operations and disables execution-capable diff and text-conversion helpers within the constrained path. Local tests reported before-and-after regression coverage. Those results support a source-level repair, not confirmation that every running container or released package contains it.

The change does not promise to sandbox deliberately available notebooks, terminals or previously trusted Git configuration. Mage's separate OAuth identity failure might affect who could obtain a session, and the repository role-check defect might affect who could invoke a write action, but neither should be collapsed into the command-injection mechanism. A full deployment review tests access rights and argument parsing independently, then checks the final child process and its filesystem effects.