Tencent/WeKnora · error

environment variable '%s' value contains null bytes

Error message

environment variable '%s' value contains null bytes

What it means

This error is raised by ValidateStdioEnvVars when an environment variable value set for a stdio MCP server contains a NUL byte ('\x00'). Null bytes are illegal in environment variables at the OS level (execve envp entries are NUL-terminated) and can be used to smuggle hidden data past naive filters. The library rejects them defensively before the process is spawned.

Source

Thrown at internal/utils/security.go:614

		for _, pattern := range DangerousEnvVarPatterns {
			if pattern.MatchString(key) {
				return fmt.Errorf("environment variable '%s' is not allowed for security reasons", key)
			}
		}

		// Check key length
		if len(key) > 256 {
			return fmt.Errorf("environment variable name '%s' exceeds maximum length", SanitizeForLog(key[:50]))
		}

		// Check value length
		if len(value) > 4096 {
			return fmt.Errorf("environment variable '%s' value exceeds maximum length", key)
		}

		// Check for null bytes in value
		if strings.Contains(value, "\x00") {
			return fmt.Errorf("environment variable '%s' value contains null bytes", key)
		}

		// Check value for shell injection patterns
		for _, pattern := range DangerousArgPatterns {
			if pattern.MatchString(value) {
				return fmt.Errorf("environment variable '%s' value contains potentially dangerous pattern", key)
			}
		}
	}

	return nil
}

// ValidateStdioConfig performs comprehensive validation of stdio configuration
// This should be called before creating or executing any stdio-based MCP client
func ValidateStdioConfig(command string, args []string, envVars map[string]string) error {
	// Validate command
	if err := ValidateStdioCommand(command); err != nil {

View on GitHub (pinned to 988cbb0330)

Solutions

1. Sanitize the env value before passing it: strip or reject any value containing '\x00' with strings.Contains(value, "\x00").
2. Fix the upstream decoding that produced the null byte (wrong encoding, binary file read as text).
3. Validate at config-load time so bad values never reach ValidateStdioConfig.

Example fix

// before
envVars["MY_VAR"] = string(rawBytes)
err := secutils.ValidateStdioConfig(cmd, args, envVars)
// after
val := strings.ReplaceAll(string(rawBytes), "\x00", "")
envVars["MY_VAR"] = val
err := secutils.ValidateStdioConfig(cmd, args, envVars)

func safeEnvValue(v string) bool { return !strings.Contains(v, "\x00") }
for k, v := range envVars {
    if !safeEnvValue(v) { return fmt.Errorf("env %q contains null bytes", k) }
}

func hasNullBytes(s string) bool { return strings.ContainsRune(s, '\x00') }

if err := secutils.ValidateStdioConfig(cmd, args, env); err != nil {
    if strings.Contains(err.Error(), "null bytes") { /* reject config */ }
}

When it happens

Trigger: Calling ValidateStdioConfig (or ValidateStdioEnvVars directly) with an envVars map where any value contains '\x00' — typically from decoding malformed binary/JSON input into a Go string.

Common situations: Env values read from corrupted config files, base64/hex blobs decoded incorrectly, or payloads assembled from binary buffers instead of text.

Related errors

• invalid environment variables: %w
• argument %d contains null bytes
• environment variable '%s' value contains potentially dangero
• invalid command: %w
• invalid arguments: %w

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/903500018bb16cc4. Report an issue: GitHub.