Description

The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters (back-ticks). For example: git.reset('atouch HACKEDb')

Remediation

References

https://snyk.io/vuln/SNYK-JS-ASYNCGIT-1064877

https://github.com/omrilotan/async-git/commit/d1950a5021f4e19d92f347614be0d85ce991510d

https://github.com/omrilotan/async-git/pull/14

Related Vulnerabilities

CVE-2020-35217 Vulnerability in maven package io.vertx:vertx-web

CVE-2017-4952 Vulnerability in maven package com.vmware.xenon:xenon-common

CVE-2022-31142 Vulnerability in npm package @fastify/bearer-auth

CVE-2021-26272 Vulnerability in npm package ckeditor4-dev

CVE-2020-5228 Vulnerability in maven package org.opencastproject:opencast-oaipmh-api

Severity

Critical

Classification

CWE-78 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Patch Third Party Advisory