The vulnerability in @grackle-ai/runtime-sdk (<=0.132.1) stems from the default git executor spawning git commands with shell:true, causing the untrusted task branch name to be concatenated into a shell command without escaping. This allows command injection via crafted branch names supplied through the PowerLine SpawnSession gRPC interface. The sanitizeBranch function only protects the directory path, not the branch argument itself. The primary fix involves removing shell:true and using execFile with argument arrays to prevent shell interpretation. Additionally, adding '--' separators before positional arguments and validating branch names at the gRPC boundary are recommended to harden the code. This vulnerability enables arbitrary command execution as the PowerLine user on all provisioned environments managed by the affected software.

An attacker with the ability to invoke the PowerLine SpawnSession RPC can achieve arbitrary command execution as the PowerLine user on all provisioned environments, including SSH hosts, Docker containers, and Codespaces. This effectively allows an attacker to escape the agent sandbox and execute arbitrary shell commands, potentially leading to full compromise of the provisioned hosts. The secondary argument injection issue has limited standalone impact but could facilitate further exploitation if combined with other flaws.

A fix is available by removing the use of shell:true in the git executor and switching to execFile with argument arrays, which prevents shell command injection. Additionally, adding '--' separators before positional git arguments and validating branch names against git ref rules at the gRPC boundary (rejecting names with '-', '..', or shell metacharacters) are recommended defense-in-depth measures. Users should upgrade to a version later than 0.132.1 once available or apply these code changes manually. Patch status is not yet confirmed; check the vendor advisory for current remediation guidance.