GHSA-mv2w-4jqc-6fg4

Command injection in libvcs and vcspull

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-21187

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	libvcs	< 0.11.1	0.11.1
PyPI	vcspull	< 1.11.1	1.11.1

Details

As written in the advisory (Markdown source, shown as plain text).

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update_repo function (when using hg), the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-21187 advisory
https://github.com/vcs-python/libvcs/pull/306 web
https://github.com/vcs-python/vcspull/commit/e1b77128a1fa0754625b5f43d8bc47956f21f33e web
https://github.com/pypa/advisory-database/tree/main/vulns/libvcs/PYSEC-2022-163.yaml web
https://github.com/vcs-python/libvcs/blob/master/CHANGES#libvcs-0111-2022-03-12 web
https://github.com/vcs-python/libvcs/blob/v0.11.1/CHANGES%23libvcs-0111-2022-03-12 web
https://github.com/vcs-python/vcspull/blob/master/CHANGES#vcspull-1111-2022-03-12 web
https://snyk.io/vuln/SNYK-PYTHON-LIBVCS-2421204 web