Potential fix for code scanning alert no. 237: Uncontrolled command line

mrubens · github-advanced-security[bot] · web-flow · commit ffca62accd9b · 2025-11-29T14:52:10.000-05:00
Co-authored-by: Copilot Autofix powered by AI &lt;62310815+github-advanced-security[bot]@users.noreply.github.com&gt;
diff --git a/apps/web-evals/src/actions/runs.ts b/apps/web-evals/src/actions/runs.ts
@@ -158,11 +158,14 @@ export async function killRun(runId: number): Promise<KillRunResult> {
 		await sleep(10000)
 
 		// Step 3: Find and kill all task runner containers for THIS run only
-		const listCommand = `docker ps --format "{{.Names}}" --filter "name=${taskPattern}"`
 		let taskContainerNames: string[] = []
 
 		try {
-			const output = execSync(listCommand, { encoding: "utf-8", timeout: 10000 })
+			const output = execFileSync(
+				"docker",
+				["ps", "--format", "{{.Names}}", "--filter", `name=${taskPattern}`],
+				{ encoding: "utf-8", timeout: 10000 }
+			)
 			taskContainerNames = output
 				.split("\n")
 				.map((name) => name.trim())
