What's wrong with this entry?
Anonymous. No account, no email.
New safety checks for shell commands:
- Detection of carriage returns (
\r) in commands, whichshell-quoteandbashtokenize differently — a potential injection vector - Detection of unquoted redirect operators in
git commitremainder arguments - Improved metacharacter detection for glob, backtick, dollar-sign, and other shell expansion characters in tool inputs
Evidence
Carriage return detection (search for "Command contains carriage return")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.