[BUG] `cortex github install --workflow-name` allows path traversal

[EnthusiasticTech]

Project

cortex

Description

Path traversal not validated early

Error Message

Debug Logs

System Information

$ bounty info
Bounty Challenge v0.1.0
OS: Linux 6.8.0-87-generic (Ubuntu 24.04.3 LTS)
CPU: Intel Core i7
RAM: 16 GB
Cortex Version: 0.1.1

Screenshots

No response

Steps to Reproduce

1. 1. Run with path traversal name
2. 2. Observe late failure

Expected Behavior

Should validate name format

Actual Behavior

Late failure

Additional Context

No response

[echobt]

Thank you for reporting this issue! We have confirmed the problem and submitted a fix.

The security issue you described regarding input validation in the workflow name parameter has been addressed. A fix is now under review here: CortexLM/cortex-cli#44

Once the fix is merged, it will be available in the next release. We appreciate your help in improving the security of Cortex!