{"version":"2.0.15","anchor":"command-flag-obfuscation-detection","canonical_anchor":"command-flag-obfuscation-detection","heading":"Command Flag Obfuscation Detection","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.0.15\/e\/command-flag-obfuscation-detection","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.0.15","markdown":"### Command Flag Obfuscation Detection\n\n**What:** Fixed quote handling in command security checks to properly detect obfuscated flags with escaped characters.\n\n**Details:**\n\n- Function `Ck6()` at line 274379 now tracks quote state and escape sequences\n- Added escape sequence tracking with `Y` flag (lines 274396-274402)\n- Properly handles single quotes (`'`) and double quotes (`\"`) separately (lines 274403-274410)\n- Checks `fullyUnquotedContent` instead of `originalCommand` for better accuracy (line 274433)\n- Prevents false positives from legitimate quoted strings in command arguments\n- **Evidence:** v2.0.14 function `y_6()` at line 273725 had simpler quote detection; v2.0.15 adds stateful quote and escape tracking (lines 274389-274411)"}