GitHub Advisoryadvisory · npm

GHSA-9gqr-xp86-f87h Code injection in npm git

MEDIUM Published 2022-03-18 Modified 2022-03-25 Official page ↗
Aliases
CVE-2021-23632
Ecosystem
npm
Packages
git
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78, CWE-94
Reviewed
2022-03-18

Affected packages

• npm git: <= 0.1.5 (no fix yet)

Description

All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just git commands. At this time, there is no known workaround. There has been no patch released.

Related

Alias · CVE (1)

  • CVE-2021-23632 All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows… vulnerability

Weakness · CWE (2)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
  • CWE-94 Improper Control of Generation of Code weakness

References