GHSA-84cm-v6jp-gjmr
OS command injection in git-diff-apply
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | git-diff-apply | < 0.22.2 | 0.22.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to 0.22.2.
References
External links from the advisory. They lead to third-party sites.