GHSA-m744-2jj8-vpfv

Command injection in git-parse

Source: GitHub Advisory Database (reviewed) High CVE-2021-26543

Packages

Ecosystem	Package	Affected	Fixed in
npm	git-parse	< 1.0.5	1.0.5

Details

As written in the advisory (Markdown source, shown as plain text).

The "gitDiff" function in Wayfair git-parse <=1.0.4 has a command injection vulnerability. Clients of the git-parse library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-26543 advisory
https://advisory.checkmarx.net/advisory/CX-2020-4302 web
https://github.com/wayfair/git-parse package
https://www.npmjs.com/package/git-parse web