CherryHQ/cherry-studio · error · Error

Invalid command: null byte detected

Error message

Invalid command: null byte detected

What it means

Thrown by validateCommand() when the trimmed command string contains a null byte (\0, U+0000). Null bytes are a classic injection vector: in C-based systems and some Node.js APIs, a null byte truncates the string at the byte boundary, so 'node\0/etc/passwd' might be interpreted as just 'node' by the validator but as a different argument by the underlying process spawn. Rejecting null bytes prevents this mismatch.

Source

Thrown at src/main/ai/mcp/McpPackageService.ts:158

export function validateCommand(command: string): string {
  if (!command || typeof command !== 'string') {
    throw new Error('Invalid command: command must be a non-empty string')
  }

  const trimmed = command.trim()
  if (!trimmed) {
    throw new Error('Invalid command: command cannot be empty')
  }

  // Check for path traversal sequences
  // This catches: .., ../, ..\, /../, \..\, etc.
  if (/(?:^|[/\\])\.\.(?:[/\\]|$)/.test(trimmed) || trimmed === '..') {
    throw new Error(`Invalid command: path traversal detected in "${command}"`)
  }

  // Check for null bytes
  if (trimmed.includes('\0')) {
    throw new Error('Invalid command: null byte detected')
  }

  return trimmed
}

/**
 * Validate command arguments to prevent injection attacks.
 * Rejects arguments containing path traversal sequences.
 *
 * @param args - The arguments array to validate
 * @returns The validated arguments array
 * @throws Error if any argument contains path traversal
 */
export function validateArgs(args: string[]): string[] {
  if (!Array.isArray(args)) {
    throw new Error('Invalid args: must be an array')
  }

View on GitHub (pinned to 726446b54c)

Solutions

1. Sanitize the command and all variable-substitution sources to strip null bytes before validation.
2. Audit user_config values to ensure they are clean text strings.
3. Do not install packages whose manifests contain null bytes — they are almost certainly malformed or malicious.

// Strip null bytes before validation (if input is trusted)
const cleaned = command.replace(/\0/g, '')
// Or reject outright
if (command.includes('\0')) {
  throw new Error('Command contains null bytes — refusing to execute')
}

When it happens

Trigger: Called from resolveMcpConfig at line 351. Triggers when the manifest's command field or a variable-substituted result contains a \0 character. This could come from raw binary data in a user_config value, a deliberately crafted manifest, or encoding corruption.

Common situations: A malicious manifest embeds a null byte to bypass downstream argument parsing; a binary file was accidentally read as a config value; encoding corruption from a cross-platform file transfer introduced null bytes; a user_config value sourced from an untrusted input contained raw bytes.

Related errors

• Invalid args: null byte detected in argument at index ${inde
• Invalid command: path traversal detected in "${command}"
• Invalid MCP package env: null byte detected in environment v
• Invalid MCP package env: null byte detected in value of envi
• Invalid command: command must be a non-empty string

AI-assisted analysis of CherryHQ/cherry-studio@726446b54c (2026-08-12). Data as JSON: /api/errors/5f955a751201a084. Report an issue: GitHub.