~ / search / GHSA-wp3j-gv53-4pg8

GHSA-wp3j-gv53-4pg8

fs-git command injection vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2017-1000451

Packages

EcosystemPackageAffectedFixed in
npm fs-git < 1.0.2 1.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

fs-git is a file system like api for git repository. The fs-git version 1.0.1 module relies on child_process.exec, however, the buildCommand method used to construct exec strings does not properly sanitize data and is vulnerable to command injection across all methods that use it and call exec.

References

External links from the advisory. They lead to third-party sites.