~ / search / GHSA-69p6-wvmq-27gg

GHSA-69p6-wvmq-27gg

Command injection in ruby-git

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-25648

Packages

EcosystemPackageAffectedFixed in
RubyGems git < 1.11.0 1.11.0

Details

As written in the advisory (Markdown source, shown as plain text).

The package prior to v1.11.0 is vulnerable to Command Injection via git argument injection. When calling the `fetch(remote = 'origin', opts = {})` function, the remote parameter is passed to the `git fetch` subcommand in a way such that additional flags can be set. The additional flags can be used to perform a command injection.

References

External links from the advisory. They lead to third-party sites.