Description

get-git-data through 1.3.1 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the arguments provided to get-git-data.

Remediation

References

https://snyk.io/vuln/SNYK-JS-GETGITDATA-564222

https://github.com/chardos/get-git-data/blob/master/index.js#L7%2C

Related Vulnerabilities

CVE-2021-24122 Vulnerability in maven package org.apache.tomcat:tomcat-catalina

CVE-2012-0803 Vulnerability in maven package org.apache.cxf:cxf-rt-ws-security

CVE-2023-46122 Vulnerability in maven package org.scala-sbt:sbt

CVE-2023-26102 Vulnerability in npm package rangy

CVE-2016-7103 Vulnerability in npm package jquery-ui

Severity

Critical

Classification

CWE-78 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory