~ / search / GHSA-6qpr-9mc5-7gch

GHSA-6qpr-9mc5-7gch

Command Injection in async-git

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-28490

Packages

EcosystemPackageAffectedFixed in
npm async-git < 1.13.2 1.13.2

Details

As written in the advisory (Markdown source, shown as plain text).

The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters (back-ticks). For example: `git.reset('atouch HACKEDb')`

References

External links from the advisory. They lead to third-party sites.