GitHub Advisoryadvisory · npm

GHSA-3f95-r44v-8mrg Command injection in simple-git

HIGH Published 2022-03-12 Modified 2022-03-17 Official page ↗
Aliases
CVE-2022-24433
Ecosystem
npm
Packages
simple-git
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-74, CWE-77
Reviewed
2022-03-14

Affected packages

• npm simple-git: < 3.3.0 → fixed in 3.3.0

Description

The package simple-git before 3.3.0 is vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options, it was possible to get arbitrary command execution.

Related

Alias · CVE (1)

  • CVE-2022-24433 The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. vulnerability

Weakness · CWE (2)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References