CherryHQ/cherry-studio · error · Error

Invalid args: null byte detected in argument at index ${inde

Error message

Invalid args: null byte detected in argument at index ${index}

What it means

Thrown by validateArgs() during the per-element map when an argument string contains a null byte (\0, U+0000). Like the command null-byte check (error 156), this prevents null-byte injection through command arguments, where a null byte could truncate or alter the argument as seen by the underlying process spawn. The check runs after the type check but before the path-traversal check.

Source

Thrown at src/main/ai/mcp/McpPackageService.ts:184

 * Rejects arguments containing path traversal sequences.
 *
 * @param args - The arguments array to validate
 * @returns The validated arguments array
 * @throws Error if any argument contains path traversal
 */
export function validateArgs(args: string[]): string[] {
  if (!Array.isArray(args)) {
    throw new Error('Invalid args: must be an array')
  }

  return args.map((arg, index) => {
    if (typeof arg !== 'string') {
      throw new Error(`Invalid args: argument at index ${index} must be a string`)
    }

    // Check for null bytes
    if (arg.includes('\0')) {
      throw new Error(`Invalid args: null byte detected in argument at index ${index}`)
    }

    // Check for path traversal in arguments that look like paths
    // Only validate if the arg contains path separators (indicating it's meant to be a path)
    if ((arg.includes('/') || arg.includes('\\')) && /(?:^|[/\\])\.\.(?:[/\\]|$)/.test(arg)) {
      throw new Error(`Invalid args: path traversal detected in argument at index ${index}`)
    }

    return arg
  })
}

export function performVariableSubstitution(
  value: string,
  extractDir: string,
  userConfig?: Record<string, any>
): string {
  let result = value

View on GitHub (pinned to 726446b54c)

Solutions

1. Sanitize all argument strings and user_config values to strip null bytes before validation.
2. Audit the manifest's args array for any non-printable characters.
3. Do not install packages whose manifests contain null bytes in arguments.

// Strip null bytes from all args before validation (if input is trusted)
const cleaned = args.map(arg => typeof arg === 'string' ? arg.replace(/\0/g, '') : arg)
// Or reject outright
const nullIndex = args.findIndex(arg => typeof arg === 'string' && arg.includes('\0'))
if (nullIndex >= 0) {
  throw new Error(`Argument at index ${nullIndex} contains null bytes`)
}

When it happens

Trigger: Called from resolveMcpConfig at line 359. Triggers when any element in the args array contains a \0 character. This could come from a malicious manifest, binary user_config values, or encoding corruption. The error message includes the index of the offending argument.

Common situations: A malicious MCP package embeds null bytes in arguments to bypass downstream argument parsing; a file path argument was read from a binary file; encoding corruption during cross-platform transfer; a user_config value sourced from untrusted input contained raw bytes.

Related errors

• Invalid command: null byte detected
• Invalid command: path traversal detected in "${command}"
• Invalid MCP package env: null byte detected in environment v
• Invalid MCP package env: null byte detected in value of envi
• Invalid command: command must be a non-empty string

AI-assisted analysis of CherryHQ/cherry-studio@726446b54c (2026-08-12). Data as JSON: /api/errors/0e926fa72222cc48. Report an issue: GitHub.