The `// sandbox` annotation restricts Deno to `--allow-run=git,/usr/bin/chromium`.
git can be coerced into spawning `/bin/sh` via hook configs such as
`git -c core.fsmonitor=<cmd> status`, and that subprocess is spawned by git —
not Deno — so it is invisible to Deno's permission model. This let any user
with script-execution permission run arbitrary OS commands as root inside the
worker, fully defeating the sandbox.
The advisory's alternative (injecting `-c core.fsmonitor=false -c
core.hooksPath=/dev/null`) does not apply here: the user's own script invokes
git directly via `Deno.Command`, so Windmill cannot inject hardening flags into
that call. Removing git from the allowlist is the only complete fix. git was
originally allowed for git-sync-adjacent use, which no longer needs it.
Verified with the advisory PoC: git invocation now returns
`Requires run access to "git"` and the sandbox escape is closed. chromium
(puppeteer) support is preserved.
Fixes WIN-2151
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Ruben Fiszel
f2a18beca4