CVE-2026-10617: Incomplete Privesc Regex Blocklistcve-2026-10617-incomplete-privesc-regex-blocklist
A regular expression blocklist explicitly blocks `sudo` but does not include `doas`. Hardcoded command blocklists are inherently incomplete and prone to bypasses (CWE-184). A missing check for `doas` can allow arbitrary command execution as root if the binary is present in the environment (e.g., `doas apk` or `doas sh`). Consider using an allow-list, robust
