~ / search / GHSA-926x-m6m5-3mmp

GHSA-926x-m6m5-3mmp

push-dir Enables OS Command Injection

Source: GitHub Advisory Database (reviewed) Critical CVE-2019-10803

Packages

EcosystemPackageAffectedFixed in
npm push-dir <= 0.4.1 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

push-dir through 0.4.1 allows execution of arbritary commands. Arguments provided as part of the variable `opt.branch` is not validated before being provided to the `git` command within [index.js#L139](https://github.com/L33T-KR3W/push-dir/blob/master/index.js#L139). This could be abused by an attacker to inject arbitrary commands.

References

External links from the advisory. They lead to third-party sites.