GitHub Advisoryadvisory · npm

GHSA-wjqc-j537-j9gj Command injection in git-it-electron

CRITICAL Published 2021-12-08 Modified 2022-08-30 Official page ↗
Aliases
CVE-2021-44685
Ecosystem
npm
Packages
git-it-electron
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2021-12-09

Affected packages

• npm git-it-electron: <= 4.3.0 (no fix yet)

Description

Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step. During the verification process, it attempts to run the reflog command followed by the current branch name (which is not sanitized for execution).

Related

Alias · CVE (1)

  • CVE-2021-44685 Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References