GitHub Advisoryadvisory · npm

GHSA-8jmw-wjr8-2x66 Command injection in git-clone

HIGH Published 2022-07-02 Modified 2023-09-07 Official page ↗
Aliases
CVE-2022-25900
Ecosystem
npm
Packages
git-clone
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-77, CWE-88
Reviewed
2022-07-06

Affected packages

• npm git-clone: <= 0.2.0 (no fix yet)

Description

All versions of package git-clone are vulnerable to Command Injection due to insecure usage of the `--upload-pack` feature of git. Credits Credit to @lirantal for discovering this vulnerability.

Related

Alias · CVE (1)

  • CVE-2022-25900 All versions of package git-clone are vulnerable to Command Injection due to insecure usage of the --upload-pack feature of git. vulnerability

Weakness · CWE (2)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness
  • CWE-88 Improper Neutralization of Argument Delimiters in a Command weakness

References