CVE-2026-45405: Untrusted Env Var As Security Limitcve-2026-45405-untrusted-env-var-as-security-limit
Configuring dynamic security limits (e.g. MAX_SIZE) via environment variables can be dangerous if the script is tied to an execution context that allows arbitrary environment variable injection (e.g. SSH daemon configs passing SendEnv). Avoid relying on unverified environment variables for critical security constraints such as resource limits. Consider using
