fix: fix security issue in odmOptionsToJson.py

[anupamme]

Summary

Fix critical severity security issue in helpers/odmOptionsToJson.py.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	helpers/odmOptionsToJson.py:37
Assessment	Likely exploitable

Description: The Python helper script helpers/odmOptionsToJson.py uses sys.argv[2] directly in sys.path.append() and load_source() calls without any sanitization or validation. An attacker who can control the arguments passed to this script when invoked from Node.js via child_process could inject shell metacharacters or point to malicious Python files to execute arbitrary code.

Evidence

Exploitation scenario: An attacker who can control the arguments passed to odmOptionsToJson.py execution (e.g., via the 'options' parameter in task creation that influences project-path) could supply a path like.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a web service - vulnerabilities in request handlers are directly exploitable by remote attackers.

Changes

• helpers/odmOptionsToJson.py

Behavior Preservation

The change is scoped to 1 file on the vulnerable path.

---

Automated security fix by OrbisAI Security