~ / search / GHSA-hf8c-xr89-vfm5

GHSA-hf8c-xr89-vfm5

Command Injection in ungit

Source: GitHub Advisory Database (reviewed) High CVE-2022-25766

Packages

EcosystemPackageAffectedFixed in
npm ungit < 1.5.20 1.5.20

Details

As written in the advisory (Markdown source, shown as plain text).

The package ungit before 1.5.20 are vulnerable to Remote Code Execution (RCE) via argument injection. The issue occurs when calling the /api/fetch endpoint. User controlled values (remote and ref) are passed to the git fetch command. By injecting some git options it was possible to get arbitrary command execution.

References

External links from the advisory. They lead to third-party sites.