fix: Update fetchLinkedPRs to prevent shell injection vulnerabilities

- Modified the fetchLinkedPRs function to use JSON.stringify for the request body, ensuring safe input handling when spawning the GitHub CLI command.
- Changed the command to read the query from stdin using the --input flag, enhancing security against shell injection risks.

apps/server/src/routes/github/routes/list-issues.ts

@@ -111,8 +111,10 @@ async function fetchLinkedPRs(
 
     try {
       // Use spawn with stdin to avoid shell injection vulnerabilities
+      // --input - reads the JSON request body from stdin
+      const requestBody = JSON.stringify({ query });
       const response = await new Promise<Record<string, unknown>>((resolve, reject) => {
-        const gh = spawn('gh', ['api', 'graphql', '-f', 'query=-'], {
+        const gh = spawn('gh', ['api', 'graphql', '--input', '-'], {
           cwd: projectPath,
           env: execEnv,
         });
@@ -133,7 +135,7 @@ async function fetchLinkedPRs(
           }
         });
 
-        gh.stdin.write(query);
+        gh.stdin.write(requestBody);
         gh.stdin.end();
       });