GitHub Advisoryadvisory · npm

GHSA-h42j-mrmp-9369 git-commit-info vulnerable to Command Injection

HIGH Published 2023-06-28 Modified 2024-10-30 Official page ↗
Aliases
CVE-2023-26134
Ecosystem
npm
Packages
git-commit-info
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-77, CWE-78
Reviewed
2023-06-30

Affected packages

• npm git-commit-info: < 2.0.2 → fixed in 2.0.2

Description

Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo() fails to sanitize its parameter commit, which later flows into a sensitive command execution API. As a result, attackers may inject arguments to the git binary.

Related

Alias · CVE (1)

  • CVE-2023-26134 Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method… vulnerability

Weakness · CWE (2)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References