~ / search / GHSA-62cx-5xj4-wfm4

GHSA-62cx-5xj4-wfm4

ggit is vulnerable to Command Injection via the fetchTags(branch) API

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-21532

Packages

EcosystemPackageAffectedFixed in
npm ggit <= 2.4.12 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

All versions of the package ggit are vulnerable to Command Injection via the fetchTags(branch) API, which allows user input to specify the branch to be fetched and then concatenates this string along with a git command which is then passed to the unsafe exec() Node.js child process API.

References

External links from the advisory. They lead to third-party sites.