From cf075632ad16b4bcfdef9c3117276e90661b2b5a Mon Sep 17 00:00:00 2001
From: Felix <3937061056@qq.com>
Date: Tue, 10 Nov 2026 01:30:23 +0000
Subject: [PATCH] fix(cli): reject NUL bytes in binary overview paths

---
 src/cli/coreBinaryCommands.ts | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/cli/coreBinaryCommands.ts b/src/cli/coreBinaryCommands.ts
index 710b3918177..bd5231467be 100644
--- a/src/cli/coreBinaryCommands.ts
+++ b/src/cli/coreBinaryCommands.ts
@@ -1,4 +1,9 @@
 import { z } from "incur";
+
+const localPath = z
+  .string()
+  .min(1)
+  .regex(/^[^\x00]*$/u, "Local path cannot contain NUL");
 import { stat } from "node:fs/promises";
 import { resolve } from "node:path";
 
@@ -48,7 +53,7 @@ const registerOverviewCommands = (
   cli.command(CLI_COMMANDS.analyze, {
     description: "Get an overview of an app",
     args: z.object({
-      path: z.string().describe("App, program, or analysis database path"),
+      path: localPath.describe("App, program, or analysis database path"),
     }),
     options: overviewOptions.extend({
       integrityPolicy: javascriptApplicationOptions.shape.integrityPolicy,