~ / search / GHSA-chj3-f7xw-367m

GHSA-chj3-f7xw-367m

OS Command Injection in git-promise

Source: GitHub Advisory Database (reviewed) High CVE-2022-24376

Packages

EcosystemPackageAffectedFixed in
npm git-promise <= 1.0.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

All versions of package git-promise is vulnerable to Command Injection due to an inappropriate fix of a prior [vulnerability](https://security.snyk.io/vuln/SNYK-JS-GITPROMISE-567476) in this package. **Note:** Please note that the vulnerability will not be fixed. The README file was updated with a warning regarding this issue. ### Credits @lirantal for discovering this vulnerability.

References

External links from the advisory. They lead to third-party sites.