Replace envsubst with JavaScript-based substitution to prevent template injection#5773

Merged

pelikhan merged 13 commits into

mainfrom

copilot/fix-template-injection-vulnerability

Dec 7, 2025

Commits on Dec 7, 2025

Initial plan
Copilot
committed
Initial assessment: Template injection vulnerability in cloclo.md

Copilot
and
mnkiefer
committed
Replace envsubst with safe sed-based substitution

Copilot
and
mnkiefer
committed
Update tests to match sed-based substitution pattern

Copilot
and
mnkiefer
committed
Fix code review comments: update docs and template wrapping

Copilot
and
mnkiefer
committed
Replace multiple sed calls with single JavaScript substitution step

Copilot
and
pelikhan
committed
Merge remote-tracking branch 'origin/main' into copilot/fix-template-injection-vulnerability
GitHub Copilot
committed
Merge main, recompile workflows, and format code

Copilot
and
pelikhan
committed
Fix JavaScript syntax error and recompile all workflows

Copilot
and
pelikhan
committed
Add changeset [skip-ci]
github-actions[bot]
committed
Merge remote-tracking branch 'origin/main' into copilot/fix-template-injection-vulnerability
GitHub Copilot
committed
Merge main and recompile workflows

Copilot
and
pelikhan
committed
Add changeset [skip-ci]
github-actions[bot]
committed