{"version":"2.1.85","anchor":"bash-tool-security-hardening","canonical_anchor":"bash-tool-security-hardening","heading":"Bash Tool Security Hardening","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.85\/e\/bash-tool-security-hardening","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.85","markdown":"### Bash Tool Security Hardening\n\nSeveral new security checks have been added to the Bash tool's command validation, particularly for Windows\/PowerShell:\n\n- **WMI process spawning detection**: Commands that \"can spawn arbitrary processes via WMI\/CIM (Win32_Process Create)\" are now flagged for manual approval\n- **Glob pattern symlink validation**: \"Glob patterns in paths cannot be statically validated \u2014 symlinks inside the glob expansion are not examined\"\n- **Archive + git exploit prevention**: \"Compound command extracts an archive and runs git. Archive contents may plant bare-repository indicators (HEAD, hooks\/, refs\/) that git then treats as the repository root\"\n- **Filesystem link creation blocking**: \"Compound command creates a filesystem link (New-Item -ItemType SymbolicLink\/Junction\/HardLink) \u2014 cannot auto-allow because path validation cannot follow just-created links\"\n- **New-PSDrive directory change detection**: Added to the compound command directory-change check alongside Set-Location, Push-Location, and Pop-Location\n- **Command length validation**: Input length limits now measured in bytes with explicit error message\n- **Windows archive tools**: `bsdtar.exe` and `gunzip.exe` added to the allowed archive tool list\n\n**Evidence**\n\nWMI check (search for `\"can spawn arbitrary processes via WMI\/CIM\"`), glob check (search for `\"Glob patterns in paths cannot be statically validated\"`)"}