GHSA-9gqr-xp86-f87h

Code injection in npm git

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-23632

Packages

Ecosystem	Package	Affected	Fixed in
npm	git	<= 0.1.5	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just git commands. At this time, there is no known workaround. There has been no patch released.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-23632 advisory
https://snyk.io/vuln/SNYK-JS-GIT-1568518 web