GitHub Advisoryadvisory · npm

GHSA-qwrq-vxvw-537r git-shallow-clone Argument Injection vulnerability

MEDIUM Published 2024-10-01 Modified 2024-11-07 Official page ↗
Aliases
CVE-2024-21531
Ecosystem
npm
Packages
git-shallow-clone
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-88
Reviewed
2024-10-01

Affected packages

• npm git-shallow-clone: <= 0.0.2 (no fix yet)

Description

All versions of the package git-shallow-clone are vulnerable to Argument injection due to missing sanitization or mitigation flags in the process variable of the gitShallowClone function.

Related

Alias · CVE (1)

  • CVE-2024-21531 All versions of the package git-shallow-clone are vulnerable to Command injection due to missing sanitization or mitigation flags in the… vulnerability

Weakness · CWE (1)

  • CWE-88 Improper Neutralization of Argument Delimiters in a Command weakness

References