Mauricio Siu b24202e69b fix(security): escape dockerImage in database service remote docker pull ...

The deploy functions for postgres/mysql/mariadb/mongo/redis/libsql interpolated
the user-settable dockerImage field unquoted into 'docker pull ${dockerImage}'
executed via execAsyncRemote (SSH) on the remote server path. Now passed through
shell-quote. The local path already used pullImage() (execFile-based) and is
unaffected.

Closes GHSA-6jrh-8qmg-jj3p

2026-07-19 22:45:31 -06:00

..

server

fix(security): escape dockerImage in database service remote docker pull

2026-07-19 22:45:31 -06:00