GitHub Advisoryadvisory · npm

GHSA-m744-2jj8-vpfv Command injection in git-parse

HIGH Published 2022-02-10 Modified 2022-02-10 Official page ↗
Aliases
CVE-2021-26543
Ecosystem
npm
Packages
git-parse
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-74
Reviewed
2021-05-19

Affected packages

• npm git-parse: < 1.0.5 → fixed in 1.0.5

Description

The "gitDiff" function in Wayfair git-parse <=1.0.4 has a command injection vulnerability. Clients of the git-parse library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.

Related

Alias · CVE (1)

  • CVE-2021-26543 The "gitDiff" function in Wayfair git-parse <=1.0.4 has a command injection vulnerability. vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References