GitHub Advisoryadvisory · npm

GHSA-8px5-63x9-5c7p pullit vulnerable to command injection

HIGH Published 2020-09-03 Modified 2023-03-28 Official page ↗
Aliases
CVE-2018-25083
Ecosystem
npm
Packages
pullit
Severity
High
Weaknesses
CWE-77
Reviewed
2020-08-31

Affected packages

• npm pullit: < 1.4.0 → fixed in 1.4.0

Description

Versions of `pullit` prior to 1.4.0 are vulnerable to Command Injection. The package does not validate input on git branch names and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system. Recommendation Upgrade to version 1.4.0 or later. Credits This vulnerability was discovered by @lirantal

Related

Alias · CVE (1)

  • CVE-2018-25083 The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name. vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References