~ / search / GHSA-vhhw-xjvf-wprr

GHSA-vhhw-xjvf-wprr

Command Injection in @graphql-tools/git-loader

Source: GitHub Advisory Database (reviewed) High CVE-2021-23326

Packages

EcosystemPackageAffectedFixed in
npm @graphql-tools/git-loader < 6.2.6 6.2.6

Details

As written in the advisory (Markdown source, shown as plain text).

This affects the package @graphql-tools/git-loader before 6.2.6. The use of exec and execSync in packages/loaders/git/src/load-git.ts allows arbitrary command injection.

References

External links from the advisory. They lead to third-party sites.