~ / search / GHSA-6c3f-p5wp-34mh

GHSA-6c3f-p5wp-34mh

OS Command Injection in async-git

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-3190

Packages

EcosystemPackageAffectedFixed in
npm async-git < 1.13.2 1.13.2

Details

As written in the advisory (Markdown source, shown as plain text).

The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. Ensure to sanitize untrusted user input before passing it to one of the vulnerable functions as a workaround or update async-git to version 1.13.1.

References

External links from the advisory. They lead to third-party sites.