~ / search / GHSA-53xj-v576-3ch2

GHSA-53xj-v576-3ch2

OS Command Injection in giting

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-10802

Packages

EcosystemPackageAffectedFixed in
npm giting <= 0.0.8 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

giting version prior to 0.0.8 allows execution of arbritary commands. The first argument `repo` of function `pull()` is executed by the package without any validation.

References

External links from the advisory. They lead to third-party sites.