ruvnet/ruflo · error · SafeExecutorError

NULL_BYTE_INJECTION

NULL_BYTE_INJECTION

Error message

Null byte detected in argument

What it means

SafeExecutor.validateArguments found a NUL byte (\0) in one of the command arguments. Null bytes can truncate or manipulated C-string based process APIs and are a classic argument-injection vector, so the whole execution is refused before spawning (shell is already disabled as defense-in-depth).

Source

Thrown at v3/@claude-flow/security/src/safe-executor.ts:260

      throw new SafeExecutorError(
        'Sudo commands are not allowed',
        'SUDO_NOT_ALLOWED',
        command
      );
    }
  }

  /**
   * Validates command arguments for injection patterns.
   *
   * @param args - Arguments to validate
   * @throws SafeExecutorError if arguments contain dangerous patterns
   */
  private validateArguments(args: string[]): void {
    for (const arg of args) {
      // Check for null bytes
      if (arg.includes('\0')) {
        throw new SafeExecutorError(
          'Null byte detected in argument',
          'NULL_BYTE_INJECTION',
          undefined,
          args
        );
      }

      // Check against blocked patterns
      for (const pattern of this.blockedPatterns) {
        if (pattern.test(arg)) {
          throw new SafeExecutorError(
            `Dangerous pattern detected in argument: ${arg}`,
            'DANGEROUS_PATTERN',
            undefined,
            args
          );
        }
      }

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Sanitize arguments to remove null bytes before passing them to the executor.
2. Investigate the caller: null bytes usually indicate binary data or an injection attempt that should be rejected earlier.

When it happens

Trigger: Thrown at v3/@claude-flow/security/src/safe-executor.ts:260 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/aa1da2f20fc507f8. Report an issue: GitHub.