From 31f4e91732da9d6560947f136d05ec8c41150df5 Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Thu, 17 Sep 2026 07:01:15 +0000
Subject: [PATCH] Fix command injection in std.notification PowerShell
 invocation on Windows

Co-authored-by: Tcode-Motion <188012755+Tcode-Motion@users.noreply.github.com>
---
 stdlib/src/notification.rs | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/stdlib/src/notification.rs b/stdlib/src/notification.rs
index a29dde0b..8db24c7a 100644
--- a/stdlib/src/notification.rs
+++ b/stdlib/src/notification.rs
@@ -34,13 +34,11 @@ impl StdlibRegistry {
                     {
                         use std::process::Command;
                         let _ = Command::new("powershell")
+                            .env("TS_NOTIFY_TITLE", &title)
+                            .env("TS_NOTIFY_BODY", &body)
                             .args([
                                 "-Command",
-                                &format!(
-                                    "[System.Windows.MessageBox]::Show('{}','{}')",
-                                    body.replace("'", "''"),
-                                    title.replace("'", "''")
-                                ),
+                                "[System.Windows.MessageBox]::Show($env:TS_NOTIFY_BODY, $env:TS_NOTIFY_TITLE)"
                             ])
                             .spawn();
                     }