qwen-code fixes flaw letting repo project hooks execute without folder trust by default
yiliang114 · ghdev · 2026-11-04
PR #16264 in QwenLM/qwen-code fixes a security issue: project hooks declared in a repo's .qwen/settings.json previously executed unconditionally, including in headless one-shot runs — meaning a freshly cloned repo could run arbitrary hooks on a default install (a proof of concept was reported).
The fix unifies one rule: project hooks load only with explicit folder trust, in every mode — interactive TUI, headless/CI, and ACP/SDK embeddings alike, with no implicit-trust exemption and intentional fail-closed behavior. User- and system-level hooks are unaffected.
This is a breaking change: automation relying on repo hooks must enable security.folderTrust.enabled and pre-trust directories in its managed home (a single TRUSTPARENT entry can cover a workspace tree). The web shell now also surfaces withheld hooks with the remedy.
More from coding & agent
- Agent turns an offhand KV cache idea into paper search and 15 tested variants — JensHonack · 2026-11-05
- Two coding agents burned 30-40 turns being polite until a transport-layer turn budget fixed it — Independent-Sir3234 · 2026-11-05
- Voice agent stack consolidation: OpenAI's vertical integration could squeeze out LiveKit and pipecat layers — juberti · 2026-11-05
- Scrapling on GitHub: 96.8k stars, one framework from single request to full crawl — abhishek__AI · 2026-11-05
- Automating a Spotify-to-YouTube Music migration with a single Codex prompt — burkov · 2026-11-05
- Peking University and NVIDIA use a coding agent to replace teleoperation for robot data — DAGroup-PKU · 2026-11-05