config.py

@@ -1,6 +1,6 @@
 # Configuration and constants for MacroPad Server
 
-VERSION = "1.1.0"
+VERSION = "1.1.1"
 DEFAULT_PORT = 40000
 SETTINGS_FILE = "settings.json"
 

macro_manager.py

@@ -416,13 +416,21 @@ class MacroManager:
 
         elif cmd_type == "app":
             # Launch application.
-            # SECURITY: shell=True was removed to kill shell-metacharacter
+            # SECURITY: never use shell=True — that would allow shell-metacharacter
-            # injection (no ; && | $() chaining). We tokenize the command
+            # injection (; && | $() chaining, redirection). Both branches below run
-            # and exec the program directly without a shell.
+            # without a shell, so the command can only launch a program with args.
             command = cmd.get("command", "")
             if command:
                 try:
-                    args = shlex.split(command, posix=(os.name != "nt"))
+                    if os.name == "nt":
+                        # Windows: pass the string so CreateProcess parses it
+                        # (correctly handling quoted paths like "C:\Program
+                        # Files\app.exe"). shell=False means no cmd.exe, so no
+                        # metacharacter chaining.
+                        subprocess.Popen(command)
+                    else:
+                        # POSIX: split into an argv list; no shell involved.
+                        args = shlex.split(command)
                         if args:
                             subprocess.Popen(args)
                 except Exception as e:

version.txt

@@ -1 +1 @@
-1.1.0
+1.1.1