GitHub Advisoryadvisory · npm

GHSA-chj3-f7xw-367m OS Command Injection in git-promise

HIGH Published 2022-06-11 Modified 2022-08-22 Official page ↗
Aliases
CVE-2022-24376
Ecosystem
npm
Packages
git-promise
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-77, CWE-88
Reviewed
2022-06-17

Affected packages

• npm git-promise: <= 1.0.0 (no fix yet)

Description

All versions of package git-promise is vulnerable to Command Injection due to an inappropriate fix of a prior vulnerability in this package. Note: Please note that the vulnerability will not be fixed. The README file was updated with a warning regarding this issue. Credits @lirantal for discovering this vulnerability.

Related

Alias · CVE (1)

  • CVE-2022-24376 All versions of package git-promise are vulnerable to Command Injection due to an inappropriate fix of a prior… vulnerability

Weakness · CWE (2)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness
  • CWE-88 Improper Neutralization of Argument Delimiters in a Command weakness

References