From 359a7b942e3c65f1a3f24c23db60269e50a0342d Mon Sep 17 00:00:00 2001
From: Kalt2212 <107548841+kalt2212@users.noreply.github.com>
Date: Wed, 7 Oct 2026 17:23:50 -0700
Subject: [PATCH] libnpmexec: escape executable name on Windows branch (cmd
 injection)

Commit 6901bb1 escaped the executable name for non-Windows shells but
left the Windows branch raw: a malicious bin entry (e.g. "x&calc")
reaches cmd.exe /d /s /c unescaped, allowing arbitrary command
execution as the user on npx.
---
 workspaces/libnpmexec/lib/run-script.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/workspaces/libnpmexec/lib/run-script.js b/workspaces/libnpmexec/lib/run-script.js
index 2de40454f9dcf..f7112a5b37d9d 100644
--- a/workspaces/libnpmexec/lib/run-script.js
+++ b/workspaces/libnpmexec/lib/run-script.js
@@ -23,6 +23,10 @@ const run = async ({
       // literally; double quotes still expand $(), backticks, $var and "
       args[0] = `'${args[0].replace(/'/g, `'\\''`)}'`
     }
+  } else if (args.length > 0) {
+    // cmd.exe: double-quote so & | < > ^ are taken literally; %VAR% still
+    // expands inside quotes, so double %; "" is cmd's quoted literal for ".
+    args[0] = `"${args[0].replace(/%/g, '%%').replace(/"/g, '""')}"`
   }
 
   // turn list of args into command string