# Discovering Negative-Days with LLM Workflows

Command injection in @next/codemod agents-md canary: execSync git clone with interpolated repo URL let a trojanized package.json devDependency execute shell commands.

- Payout: Research
- Severity: medium
- Program: Next.js
- Write-up by: Eugene Lim
- Disclosed: 2026-02-07
- Write-up quality: 6/10
- Original: https://spaceraccoon.dev/discovering-negative-days-llm-workflows/
- Library page: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-discovering-negative-days-llm-workflows
- Tags: area:oss domain:oss impact:rce kind:research platform:research sev:medium tech:nodejs technique:recon technique:source-review vuln:command-injection

**Target:** @next/codemod agents-md CLI (npm package)
**Root cause:** Git commands were built via execSync string interpolation of repo URL/paths instead of argument arrays, so shell metacharacters in inputs were interpreted by the shell.
**Steps:**
1. Create a repo with package.json devDependencies containing `"next": "$(touch /tmp/testpoc)"`
2. Run `npx @next/[email protected] agents-mod --output CLAUDE.md` against the trojanized repo
3. The interpolated dependency string reaches execSync git command and the shell executes `touch /tmp/testpoc`
**How found:** Built an LLM GitHub Action monitoring commits/PRs for security-patch signals; it flagged a Windows path-fix commit that also switched execSync to execa, prompting manual verification and PoC.
**Exploitation:** Attacker publishes a repo whose package.json devDependency value contains shell metacharacters; a victim running the agents-md codemod on that repo triggers execSync with the interpolated string, executing arbitrary commands on the victim's machine.
**Insight:** Commits that 'incidentally' swap execSync/shell strings for execa/array args while fixing an unrelated bug are strong command-injection signals; monitor public repo commits and PRs pre-CVE for such hardening changes.