Description

The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag.

Remediation

References

https://advisory.checkmarx.net/advisory/CX-2021-4772

https://github.com/omrilotan/async-git/pull/13

https://github.com/omrilotan/async-git/pull/13/commits/611823bd97dd41e9e8127c38066868ff9dcfa57a

https://github.com/omrilotan/async-git/pull/13/commits/a5f45f58941006c4cc1699609383b533d9b92c6a

https://github.com/omrilotan/async-git/pull/14

Related Vulnerabilities

CVE-2019-1010091 Vulnerability in maven package org.webjars:tinymce

CVE-2020-9296 Vulnerability in maven package com.netflix.conductor:conductor-core

CVE-2020-7633 Vulnerability in npm package apiconnect-cli-plugins

CVE-2023-26127 Vulnerability in npm package n158

CVE-2017-16098 Vulnerability in npm package charset

Severity

Critical

Classification

CWE-78 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Third Party Advisory Patch