From 27343244ce5298538c20f208d084b55d333f082e Mon Sep 17 00:00:00 2001
From: orbisai0security <mediratta@gmail.com>
Date: Mon, 20 Jul 2026 12:39:29 +0000
Subject: [PATCH] fix: ruby.lang.security.dangerous-subshell.dangerous-subshell
 security vulnerability

Automated security fix generated by OrbisAI Security
---
 bindings/ruby/extsources.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bindings/ruby/extsources.rb b/bindings/ruby/extsources.rb
index 850ac9841..50f8edf34 100644
--- a/bindings/ruby/extsources.rb
+++ b/bindings/ruby/extsources.rb
@@ -46,7 +46,7 @@ ignored_exts = %w[
 ]
 
 EXTSOURCES =
-  `git ls-files -z #{root}`.split("\x0")
+  IO.popen(["git", "ls-files", "-z", root.to_s], &:read).split("\x0")
     .collect {|file| Pathname(file)}
     .reject {|file|
       ignored_exts.include?(file.extname) ||