From 842567fb89c20f28b94159e31d44e520ff1f40ef Mon Sep 17 00:00:00 2001
From: Anupam Mediratta <mediratta@gmail.com>
Date: Mon, 27 Jul 2026 18:01:52 +0530
Subject: [PATCH] fix: V-001 security vulnerability (#5951)

Automated security fix generated by OrbisAI Security
---
 V2rayNG/app/src/main/java/com/v2ray/ang/root/RootShell.kt | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/V2rayNG/app/src/main/java/com/v2ray/ang/root/RootShell.kt b/V2rayNG/app/src/main/java/com/v2ray/ang/root/RootShell.kt
index c07719e5..e69ee873 100644
--- a/V2rayNG/app/src/main/java/com/v2ray/ang/root/RootShell.kt
+++ b/V2rayNG/app/src/main/java/com/v2ray/ang/root/RootShell.kt
@@ -26,10 +26,11 @@ object RootShell {
             writeText(script)
             setExecutable(true, false)
         }
-        return exec("sh ${file.absolutePath}")
+        val safePath = file.absolutePath.replace("'", "'\\''")
+        return exec("sh '$safePath'")
     }
 
-    fun exec(command: String, timeoutSeconds: Long = 30): Result {
+    private fun exec(command: String, timeoutSeconds: Long = 30): Result {
         return try {
             val process = ProcessBuilder("su", "-c", command)
                 .redirectErrorStream(true)