# Risk map — spf13/cobra

> Canonical page: https://codevetter.com/unpack/cobra/risk-map

# Risk map — spf13/cobra

Scanned commit adbc8813901bba65827259daa8e22ff94ec1f30e (2026-07-10). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

These findings are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. Sensitive boundaries include evaluated shell requests, caller-selected file destinations, environment-controlled logging, and process termination. Mutable command and global state also couples otherwise separate uses of the library. Actual exploitability and downstream application security were not tested.
- Generated Bash requests use eval, PowerShell uses Invoke-Expression, and Fish escapes arguments before eval; hypothesis: quoting regressions at these boundaries could reinterpret shell input and need shell-specific reproduction. (inferred) — [bash_completionsV2.go#L54-84](https://github.com/spf13/cobra/blob/adbc8813901bba65827259daa8e22ff94ec1f30e/bash_completionsV2.go#L54-L84) [powershell_completions.go#L109-129](https://github.com/spf13/cobra/blob/adbc8813901bba65827259daa8e22ff94ec1f30e/powershell_completions.go#L109-L129) [fish_completions.go#L48-59](https://github.com/spf13/cobra/blob/adbc8813901bba65827259daa8e22ff94ec1f30e/fish_completions.go#L48-L59)
- CompDebug accepts BASH_COMP_DEBUG_FILE as an unrestricted destination and opens it with append/create/write flags and mode 0644; open failures are ignored, while write errors flow through CheckErr. — [completions.go#L955-974](https://github.com/spf13/cobra/blob/adbc8813901bba65827259daa8e22ff94ec1f30e/completions.go#L955-L974) [cobra.go#L234-245](https://github.com/spf13/cobra/blob/adbc8813901bba65827259daa8e22ff94ec1f30e/cobra.go#L234-L245)
- Documentation and completion-file APIs use os.Create on caller-selected paths, which permits overwriting existing files; tree generation can leave earlier descendant files written when a later step fails. — [doc/md_docs.go#L133-155](https://github.com/spf13/cobra/blob/adbc8813901bba65827259daa8e22ff94ec1f30e/doc/md_docs.go#L133-L155) [doc/man_docs.go#L48-79](https://github.com/spf13/cobra/blob/adbc8813901bba65827259daa8e22ff94ec1f30e/doc/man_docs.go#L48-L79) [bash_completionsV2.go#L470-478](https://github.com/spf13/cobra/blob/adbc8813901bba65827259daa8e22ff94ec1f30e/bash_completionsV2.go#L470-L478)
- Normal pre-hooks run before required-flag and flag-group validation; RunE errors bypass command post-hooks, whereas deferred global finalizers are already installed after preRun. — [command.go#L959-970](https://github.com/spf13/cobra/blob/adbc8813901bba65827259daa8e22ff94ec1f30e/command.go#L959-L970) [command.go#L984-1027](https://github.com/spf13/cobra/blob/adbc8813901bba65827259daa8e22ff94ec1f30e/command.go#L984-L1027) [command.go#L1053-1057](https://github.com/spf13/cobra/blob/adbc8813901bba65827259daa8e22ff94ec1f30e/command.go#L1053-L1057)
- Template functions, initializer/finalizer lists, and execution switches are package-global mutable state without synchronization in their setters; completion callback registration separately uses an RWMutex. — [cobra.go#L32-66](https://github.com/spf13/cobra/blob/adbc8813901bba65827259daa8e22ff94ec1f30e/cobra.go#L32-L66) [cobra.go#L83-106](https://github.com/spf13/cobra/blob/adbc8813901bba65827259daa8e22ff94ec1f30e/cobra.go#L83-L106) [completions.go#L170-195](https://github.com/spf13/cobra/blob/adbc8813901bba65827259daa8e22ff94ec1f30e/completions.go#L170-L195)
- Legacy Bash generation iterates the global callback registry and rewrites each registered flag's BashCompCustom annotation using the current command's root name, including flags outside that command tree. — [bash_completions.go#L535-551](https://github.com/spf13/cobra/blob/adbc8813901bba65827259daa8e22ff94ec1f30e/bash_completions.go#L535-L551)
- Completion group enforcement mutates required annotations and Hidden flags; YAML genFlagResult visits all flags without the hidden/deprecated filtering implemented by manPrintFlags. — [flag_groups.go#L240-269](https://github.com/spf13/cobra/blob/adbc8813901bba65827259daa8e22ff94ec1f30e/flag_groups.go#L240-L269) [flag_groups.go#L273-285](https://github.com/spf13/cobra/blob/adbc8813901bba65827259daa8e22ff94ec1f30e/flag_groups.go#L273-L285) [doc/yaml_docs.go#L149-174](https://github.com/spf13/cobra/blob/adbc8813901bba65827259daa8e22ff94ec1f30e/doc/yaml_docs.go#L149-L174) [doc/man_docs.go#L159-163](https://github.com/spf13/cobra/blob/adbc8813901bba65827259daa8e22ff94ec1f30e/doc/man_docs.go#L159-L163)
- Malformed custom templates can panic through template.Must, missing group IDs panic during ExecuteC, and YAML marshal failure or CheckErr can terminate the embedding process. — [cobra.go#L179-187](https://github.com/spf13/cobra/blob/adbc8813901bba65827259daa8e22ff94ec1f30e/cobra.go#L179-L187) [command.go#L1205-1212](https://github.com/spf13/cobra/blob/adbc8813901bba65827259daa8e22ff94ec1f30e/command.go#L1205-L1212) [doc/yaml_docs.go#L137-140](https://github.com/spf13/cobra/blob/adbc8813901bba65827259daa8e22ff94ec1f30e/doc/yaml_docs.go#L137-L140) [cobra.go#L234-239](https://github.com/spf13/cobra/blob/adbc8813901bba65827259daa8e22ff94ec1f30e/cobra.go#L234-L239)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)