GitHub Advisoryadvisory · npm

GHSA-vhhw-xjvf-wprr Command Injection in @graphql-tools/git-loader

HIGH Published 2021-01-29 Modified 2022-05-31 Official page ↗
Aliases
CVE-2021-23326
Ecosystem
npm
Packages
@graphql-tools/git-loader
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-77
Reviewed
2021-01-22

Affected packages

• npm @graphql-tools/git-loader: < 6.2.6 → fixed in 6.2.6

Description

This affects the package @graphql-tools/git-loader before 6.2.6. The use of exec and execSync in packages/loaders/git/src/load-git.ts allows arbitrary command injection.

Related

Alias · CVE (1)

  • CVE-2021-23326 This affects the package @graphql-tools/git-loader before 6.2.6. vulnerability

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References