fix(@angular/cli): resolve executables strictly from PATH

packages/angular/cli/src/commands/update/utilities/git.ts

@@ -8,6 +8,9 @@
 
 import { execFileSync } from 'node:child_process';
 import * as path from 'node:path';
+import { findExecutableOnPath } from '../../../utilities/executable';
+
+let cachedGitPath: string | undefined;
 
 /**
  * Execute a git command.
@@ -16,7 +19,15 @@ import * as path from 'node:path';
  * @returns The output of the command.
  */
 function execGit(args: string[], input?: string): string {
- return execFileSync('git', args, { encoding: 'utf8', stdio: 'pipe', input });
+ if (!cachedGitPath) {
+ const gitPath = findExecutableOnPath('git');
+ if (!gitPath) {
+ throw new Error('Git executable not found on PATH.');
+ }
+ cachedGitPath = gitPath;
+ }
+
+ return execFileSync(cachedGitPath, args, { encoding: 'utf8', stdio: 'pipe', input });
 }
 
 /**

packages/angular/cli/src/utilities/completion.ts

@@ -16,6 +16,7 @@ import { getWorkspace } from '../utilities/config';
 import { forceAutocomplete } from '../utilities/environment-options';
 import { isTTY } from '../utilities/tty';
 import { assertIsError } from './error';
+import { findExecutableOnPath } from './executable';
 import { askConfirmation } from './prompt';
 
 /** Interface for the autocompletion configuration stored in the global workspace. */
@@ -271,7 +272,14 @@ function getShellRunCommandCandidates(shell: string, home: string): string[] | u
 export function hasGlobalCliInstall(): Promise<boolean> {
  // List all binaries with the `ng` name on the user's `$PATH`.
  return new Promise<boolean>((resolve) => {
- execFile('which', ['-a', 'ng'], (error, stdout) => {
+ const whichPath = findExecutableOnPath('which');
+ if (!whichPath) {
+ resolve(false);
+
+ return;
+ }
+
+ execFile(whichPath, ['-a', 'ng'], (error, stdout) => {
  if (error) {
  // No instances of `ng` on the user's `$PATH`
 

packages/angular/cli/src/utilities/executable.ts

@@ -0,0 +1,60 @@
+/**
+ * @license
+ * Copyright Google LLC All Rights Reserved.
+ *
+ * Use of this source code is governed by an MIT-style license that can be
+ * found in the LICENSE file at https://angular.dev/license
+ */
+
+import { existsSync } from 'node:fs';
+import { delimiter, extname, isAbsolute, join } from 'node:path';
+
+/**
+ * Searches the `PATH` environment variable for a given executable binary name.
+ * On Windows, checks extensions in `PATHEXT` (e.g. `.exe`, `.cmd`) if no extension is given.
+ * Returns the absolute path of the binary if found on `PATH`, or `undefined` if not found.
+ *
+ * This prevents `execFileSync` / `spawn` from implicitly resolving executables
+ * relative to `process.cwd()` on Windows when passed bare command names.
+ *
+ * @param binaryName Name of the binary to search for (e.g. 'git').
+ * @returns The absolute path to the binary if found on `PATH`, or `undefined`.
+ */
+export function findExecutableOnPath(binaryName: string): string | undefined {
+ const envPath = process.env.PATH || process.env.Path || '';
+ if (!envPath) {
+ return undefined;
+ }
+
+ const isWindows = process.platform === 'win32';
+ const pathExt = process.env.PATHEXT
+ ? process.env.PATHEXT.split(delimiter)
+ : ['.com', '.exe', '.bat', '.cmd'];
+
+ const hasExt = isWindows && extname(binaryName) !== '';
+ const extensions = isWindows && !hasExt ? pathExt : [''];
+
+ for (const rawDir of envPath.split(delimiter)) {
+ if (!rawDir) {
+ continue;
+ }
+
+ const dir = rawDir.startsWith('"') && rawDir.endsWith('"') ? rawDir.slice(1, -1) : rawDir;
+ if (!isAbsolute(dir)) {
+ continue;
+ }
+
+ for (const ext of extensions) {
+ const candidate = join(dir, binaryName + ext);
+ try {
+ if (existsSync(candidate)) {
+ return candidate;
+ }
+ } catch {
+ // Ignore file system errors (e.g. invalid path or permission error)
+ }
+ }
+ }
+
+ return undefined;
+}

packages/angular/cli/src/utilities/executable_spec.ts

@@ -0,0 +1,52 @@
+/**
+ * @license
+ * Copyright Google LLC All Rights Reserved.
+ *
+ * Use of this source code is governed by an MIT-style license that can be
+ * found in the LICENSE file at https://angular.dev/license
+ */
+
+import { dirname } from 'node:path';
+import { findExecutableOnPath } from './executable';
+
+describe('findExecutableOnPath', () => {
+ it('should find executable on PATH when it exists', () => {
+ // 'node' binary should be present on PATH in any Node test environment
+ const nodePath = findExecutableOnPath('node');
+ expect(nodePath).toBeDefined();
+ expect(nodePath).toContain('node');
+ });
+
+ it('should return undefined when binary does not exist on PATH', () => {
+ const nonExistentPath = findExecutableOnPath('non_existent_binary_123456789');
+ expect(nonExistentPath).toBeUndefined();
+ });
+
+ it('should correctly handle PATH entries wrapped in double quotes', () => {
+ const nodePath = findExecutableOnPath('node');
+ if (!nodePath) {
+ return;
+ }
+
+ const originalPath = process.env.PATH;
+ try {
+ const dir = dirname(nodePath);
+ process.env.PATH = `"${dir}"`;
+ const resolved = findExecutableOnPath('node');
+ expect(resolved).toBeDefined();
+ } finally {
+ process.env.PATH = originalPath;
+ }
+ });
+
+ it('should ignore relative PATH entries', () => {
+ const originalPath = process.env.PATH;
+ try {
+ process.env.PATH = '.';
+ const resolved = findExecutableOnPath('node');
+ expect(resolved).toBeUndefined();
+ } finally {
+ process.env.PATH = originalPath;
+ }
+ });
+});