Skip to content

shell: true causes security warning in Node 24.4.1 #1208

@Sidnioulz

Description

@Sidnioulz

Root cause

shell: true, // we'll deal with escaping ourselves (for now)

Repro
Run in node 24.4.1

const cp = require('child_process');
cp.spawn('git', ['log'], { shell: true });

You'll see the same warning.

We see this warning when running Storybook from the Storybook monorepo, through the Chromatic visual-tests-addon, and the code/lib/cli-storybook/test/default/cli.test.cjs tests are failing because the same security warning appears in our output.

Metadata

Metadata

Assignees

Labels

EmpathyreleasedVerdict: This issue/pull request has been released

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions