Description

The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag.

Remediation

References

https://github.com/omrilotan/async-git/pull/13/commits/a5f45f58941006c4cc1699609383b533d9b92c6a

https://github.com/omrilotan/async-git/pull/14

https://github.com/omrilotan/async-git/pull/13

https://github.com/omrilotan/async-git/pull/13/commits/611823bd97dd41e9e8127c38066868ff9dcfa57a

https://advisory.checkmarx.net/advisory/CX-2021-4772

Related Vulnerabilities

CVE-2022-36889 Vulnerability in maven package org.jenkins-ci.plugins:deployer-framework

CVE-2023-43256 Vulnerability in npm package gladys

CVE-2021-25941 Vulnerability in npm package deep-override

CVE-2023-37956 Vulnerability in maven package org.jenkins-ci.plugins:test-results-aggregator

CVE-2021-26543 Vulnerability in npm package git-parse

Severity

Critical

Classification

CWE-78 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Patch Third Party Advisory Exploit