{"version":"2.1.224","anchor":"server-supplied-cli-arguments-are-validated-on-self-hosted-r","canonical_anchor":"server-supplied-cli-arguments-are-validated-on-self-hosted-r","heading":"Server-supplied CLI arguments are validated on self-hosted runners","tier":"internal","area":"Self-Hosted Runners","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224\/e\/server-supplied-cli-arguments-are-validated-on-self-hosted-r","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224","markdown":"### Server-supplied CLI arguments are validated on self-hosted runners\n\nSelf-hosted runners now reject malformed or blocklisted CLI arguments handed down by the server.\n\n**What**\n\nArguments the server hands to a self-hosted runner session are now checked against a name pattern and a blocklist before becoming CLI flags. Rejected ones are skipped and logged as \"malformed\" or \"blocked\", and the count of arguments actually applied is logged.\n\n**Details**\n\n- Values starting with `-` are passed as `--name=value` so they are not parsed as a separate flag.\n- Log lines are assembled from a template beginning \"[runner:session] Skipping \".\n\n**Evidence**\n\n`[runner:session] Skipping `\n\n- Area: Self-Hosted Runners\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 3\/5"}