GitHub Advisoryadvisory · npm

GHSA-62cx-5xj4-wfm4 ggit is vulnerable to Command Injection via the fetchTags(branch) API

MEDIUM Published 2024-10-08 Modified 2024-10-08 Official page ↗
Aliases
CVE-2024-21532
Ecosystem
npm
Packages
ggit
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-78
Reviewed
2024-10-08

Affected packages

• npm ggit: <= 2.4.12 (no fix yet)

Description

All versions of the package ggit are vulnerable to Command Injection via the fetchTags(branch) API, which allows user input to specify the branch to be fetched and then concatenates this string along with a git command which is then passed to the unsafe exec() Node.js child process API.

Related

Alias · CVE (1)

  • CVE-2024-21532 All versions of the package ggit are vulnerable to Command Injection via the fetchTags(branch) API, which allows user input to specify the… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References