mcp-server-macos-reminders

The `ReminderServiceImpl.sanitizeForAppleScript` function, used to sanitize user inputs (like list names and reminder names) before embedding them into AppleScript commands, only escapes double quotes (`"`). This is insufficient. An attacker could inject single quotes (`'`), backslashes (`\`), or newline characters (`\n`, `\r`) into inputs, which would break the AppleScript syntax. This could lead to a denial of service (script failure) or, more critically, allow for AppleScript injection where arbitrary `do shell script` commands could be executed on the user's macOS system. For instance, if a reminder name includes an unescaped single quote, the generated AppleScript will be syntactically invalid.