From 276f9d788b955457ab4b5dcbc47f8c1c445f6c4a Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Wed, 21 Oct 2026 16:02:47 +0000
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[HIGH]=20Fi?=
 =?UTF-8?q?x=20Sandbox=20Environment=20Variable=20Leakage?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

🚨 Severity: HIGH
💡 Vulnerability: The `runSandboxedNodeScript` and `runSandboxedNodeScriptAsync` functions in `packages/core/src/sandbox.ts` were passing `options.env` directly to Node's `child_process.spawn()` and `spawnSync()`. When `options.env` is `undefined` (which it is by default), Node.js automatically inherits `process.env` from the host. This silently leaks sensitive host environment variables (e.g. API keys, secrets) into the sandboxed scripts execution.
🎯 Impact: Untrusted code running in the sandbox could access sensitive credentials from the host environment, bypassing the intended isolation.
🔧 Fix: Updated the `env` option in the spawn calls to `env: options.env ?? {}`, explicitly preventing environment variable inheritance unless an environment is explicitly supplied.
✅ Verification: Ran a test within `SecureSandbox` checking `process.env.PATH` and verified it evaluates to undefined. All unit tests pass.

Co-authored-by: connerkup <72580335+connerkup@users.noreply.github.com>
---
 .jules/sentinel.md           | 4 ++++
 packages/core/src/sandbox.ts | 4 ++--
 2 files changed, 6 insertions(+), 2 deletions(-)
 create mode 100644 .jules/sentinel.md

diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 0000000..1d31cae
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2024-05-18 - [Sandbox Environment Leakage]
+**Vulnerability:** The sandbox was leaking the host's environment variables (process.env) into the sandboxed child processes.
+**Learning:** Node's `child_process.spawn()` and `spawnSync()` default to inheriting `process.env` when the `env` option is `undefined`. This bypasses sandbox isolation if the environment object is not explicitly provided.
+**Prevention:** Always explicitly set `env: options.env ?? {}` in child process options when executing untrusted code to enforce a clean environment.
diff --git a/packages/core/src/sandbox.ts b/packages/core/src/sandbox.ts
index 1daaa7b..58bc9b3 100644
--- a/packages/core/src/sandbox.ts
+++ b/packages/core/src/sandbox.ts
@@ -42,7 +42,7 @@ export function runSandboxedNodeScript(
   try {
     const result = spawnSync(process.execPath, [scriptPath], {
       cwd: options.cwd,
-      env: options.env,
+      env: options.env ?? {},
       encoding: "utf8",
       timeout: options.timeoutMs ?? DEFAULT_CPU_TIMEOUT_MS,
       killSignal: "SIGKILL",
@@ -85,7 +85,7 @@ export function runSandboxedNodeScriptAsync(
 
     const child = spawn(process.execPath, [scriptPath], {
       cwd: options.cwd,
-      env: options.env,
+      env: options.env ?? {},
       stdio: ["ignore", "pipe", "pipe"],
     });