fix: remove unsafe exec() in vt100.c

[orbisai0security]

Summary

Fix critical severity security issue in src/vt100.c.

Vulnerability

Field	Value
ID	V-003
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-003
File	src/vt100.c:182

Description: At src/vt100.c:182, the application constructs a shell command string by embedding opt_cmd[i] directly into an sprintf format string without any sanitization or escaping. If opt_cmd[i] contains shell metacharacters such as single quotes, semicolons, backticks, or pipe characters, the resulting command string will execute arbitrary shell commands when passed to system() or popen(). An attacker who can influence opt_cmd values via command-line arguments or configuration achieves arbitrary command execution. The sprintf call is also unbounded and can overflow echo_cmd if opt_cmd[i] is sufficiently long.

Changes

• src/vt100.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security

[vercel]

@orbisai0security is attempting to deploy a commit to the Hao Nguyen's projects Team on Vercel.

A member of the Team first needs to authorize it.