GHSA-h7pf-67p2-535f: 
JavaScript vulnerability analysis and mitigation

The pre-tool hook hooks/universal/pre-tool/graph-command-classifier.mjs decides whether a shell command is consequential (deploy, publish, release) and needs approval. Its executable() prefix stripper only understands assignments, env, command and npx. A command whose program word is a transparent wrapper such as nohup, or a shell reserved word that starts a compound-command body (do, then, else, if, while, {, !), is classified as "allow", while bash still runs the wrapped deploy. Harmless check: classify for i in 1; do vercel deploy; done in deploy mode and observe decision allow. Impact: an agent (for example a prompt-injected one) can run a deploy or publish without the approval gate. Fix: strip reserved words and known transparent wrappers before classification, and fail closed on wrappers whose options are not parsed. A seeded differential property test against bash with PATH stubs guards the fix. The fix also covers command words hidden by ANSI-C or locale quoting and command words that come from an expansion. It also covers per-command git configuration aliases, package-runner launchers such as npm exec and npm x, and case-variant program and ref spellings on case-insensitive filesystems. In sealed mode, any program not known to only read that writes under a .git path is refused. In guarded modes the classifier now blocks anything it cannot resolve, so some harmless commands are refused too.