GHSA-qffw-8wg7-h665
Command injection in git-interface
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | git-interface | < 2.1.2 | 2.1.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
A command injection vulnerability exists in git-interface in the GitHub repository yarkeev/git-interface prior to 2.1.2. If both the git remote and destination directory are provided by user input, then the use of an `--upload-pack` command-line argument feature of git is also supported for `git clone`, which would then allow for any operating system command to be spawned by the attacker.
References
External links from the advisory. They lead to third-party sites.