From 16f82f3084d2b02e58b58a90b579ff20f3e0ba06 Mon Sep 17 00:00:00 2001
From: Alan Agius <alanagius@google.com>
Date: Thu, 6 Aug 2026 12:17:57 +0000
Subject: [PATCH] fix(ng-dev): prevent current working directory executable
 injection on Windows

Sets NoDefaultCurrentDirectoryInExePath=1 during CLI initialization on Windows
to ensure CreateProcess does not search the current working directory for bare
executable names.

Fixes #3897
---
 ng-dev/cli.ts | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/ng-dev/cli.ts b/ng-dev/cli.ts
index 6786354c05..d4c37042ce 100644
--- a/ng-dev/cli.ts
+++ b/ng-dev/cli.ts
@@ -27,6 +27,12 @@ import {Argv} from 'yargs';
 
 runParserWithCompletedFunctions((yargs: Argv) => {
   process.exitCode = 0;
+
+  // Ensure Windows CreateProcess does not search the current directory for bare executable names.
+  if (process.platform === 'win32') {
+    process.env['NoDefaultCurrentDirectoryInExePath'] = '1';
+  }
+
   return yargs
     .scriptName('ng-dev')
     .middleware([captureLogOutputForCommand, ngDevVersionMiddleware], true)