# Model arguments parsed as CLI options

Model-supplied strings reaching argv without --end-of-options or leading-dash rejection

_Area: AI and LLM app security. Seen in 3 disclosed reports; latest 2026-10-07. Updated 2026-10-24._

## How it works
A tool wrapper takes a string produced by the model (a revision, a command, a path) and appends it to an argv list for git, bash or a similar utility. The wrapper assumes the string is data. But the utility's own option parser runs first: any element starting with `-` is read as a flag, not a value. A `--` before a pathspec only ends pathspec parsing; it does not protect earlier positional arguments. So the model controls which options the process runs with, and options like `--contents=`, `--output=` or a `bash -c` wrapper turn a read-only tool into file read, file write or command execution [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-c6mw-8xh8-gpq6.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-7j5w-7r7x-9v27.md)[E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-w794-rj3p-xv45.md).

## Where it shows up
- Tool code that builds argv by concatenation or list-append from a model or user field, with no `--end-of-options` sentinel and no leading-hyphen rejection [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-c6mw-8xh8-gpq6.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-7j5w-7r7x-9v27.md).
- A `--` separator placed before the path but after an untrusted positional argument [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-c6mw-8xh8-gpq6.md).
- Config or flow fields (command, args) passed into `bash -c` or `exec` with only a presence check such as "is npx/Node installed" [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-w794-rj3p-xv45.md).
- Tools registered as Auto-approval or ReadOnly that still reach a subcommand with file-writing or file-reading flags [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-7j5w-7r7x-9v27.md).
- JSON schemas that put no pattern on a field that becomes an argv element [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-7j5w-7r7x-9v27.md).

## How to review
For each argv element, ask: can the model set its value, and is it placed after a `--end-of-options` (or equivalent) sentinel, or rejected if it starts with `-`? The invariant: every untrusted value must be a value to the utility, never an option. Check each element separately — bounding the path does not bound the rev [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-c6mw-8xh8-gpq6.md). For command/args configs, require an allowlist of executable and arguments rather than a shell string [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-w794-rj3p-xv45.md). Trace every entry path for the same field: REST API, flow JSON, tweaks, deprecated components [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-w794-rj3p-xv45.md).

## Variants seen
- Arbitrary file read via `git blame --contents=` from an unbounded rev [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-c6mw-8xh8-gpq6.md).
- Arbitrary file write via `git show --output=` from an auto-approved tool [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-7j5w-7r7x-9v27.md).
- OS command injection via `bash -c` wrapping user-supplied MCP stdio command/args [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-w794-rj3p-xv45.md).

## Why fixes fail
Fixing only the REST validator leaves the flow-JSON and component paths open [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-w794-rj3p-xv45.md). Adding `--` before the pathspec does not stop option parsing of earlier arguments [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-c6mw-8xh8-gpq6.md).

## Impact and severity
Host RCE reachable unauthenticated under default AUTO_LOGIN [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-w794-rj3p-xv45.md); arbitrary host file read past the workspace boundary [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-c6mw-8xh8-gpq6.md); arbitrary file overwrite via prompt injection on an auto-approved tool [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-7j5w-7r7x-9v27.md). Severity rises when the tool is auto-approved or read-only-labelled, since no human gate stands between model output and the sink.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-w794-rj3p-xv45.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-c6mw-8xh8-gpq6.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-7j5w-7r7x-9v27.md