GHSA-g4xg-fxmg-vcg5

OS command injection in ripgrep

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-3013

Packages

Ecosystem	Package	Affected	Fixed in
crates.io	ripgrep	< 13.0.0	13.0.0
crates.io	grep-cli	< 0.1.6	0.1.6

Details

As written in the advisory (Markdown source, shown as plain text).

ripgrep before 13 on Windows allows attackers to trigger execution of arbitrary programs from the current working directory via the -z/--search-zip or --pre flag.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-3013 advisory
https://github.com/BurntSushi/ripgrep/issues/1773 web
https://github.com/BurntSushi/ripgrep package
https://github.com/BurntSushi/ripgrep/blob/e48a17e1891e1ea9dd06ba0e48d5fb140ca7c0c4/CHANGELOG.md web
https://github.com/BurntSushi/ripgrep/blob/master/CHANGELOG.md web
https://github.com/BurntSushi/ripgrep/blob/master/CHANGELOG.md#1300-2021-06-12 web
https://rustsec.org/advisories/RUSTSEC-2021-0071.html web