GHSA-8px5-63x9-5c7p

pullit vulnerable to command injection

Source: GitHub Advisory Database (reviewed) High CVE-2018-25083

Packages

Ecosystem	Package	Affected	Fixed in
npm	pullit	< 1.4.0	1.4.0

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of `pullit` prior to 1.4.0 are vulnerable to Command Injection. The package does not validate input on git branch names and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system. ## Recommendation Upgrade to version 1.4.0 or later. ## Credits This vulnerability was discovered by @lirantal

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-25083 advisory
https://github.com/jkup/pullit/issues/23 web
https://github.com/jkup/pullit/commit/4fec455774ee08f4dce0ef2ef934ffcc37219bfb web
https://hackerone.com/reports/315773 web
https://github.com/jkup/pullit package
https://security.snyk.io/vuln/npm:pullit:20180214 web