piuccio/git-promise · Security
OS Command Injection in git-promise
- GHSA ID
- GHSA-chj3-f7xw-367m
- CVE ID
- CVE-2022-24376
- Severity
- high
- Published
- Updated
- CVSS
- 7.2 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 7.2 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Description
All versions of package git-promise is vulnerable to Command Injection due to an inappropriate fix of a prior vulnerability in this package. Note: Please note that the vulnerability will not be fixed. The README file was updated with a warning regarding this issue.
Credits
@lirantal for discovering this vulnerability.
CWEs
- CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
- CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-24376 ↗
- https://gist.github.com/lirantal/9da1fceb32f5279eb76a5fc1cb9707dd ↗
- https://snyk.io/vuln/SNYK-JS-GITPROMISE-2434310 ↗
- https://github.com/lirantal/git-promise/commit/030e4f993f3b65419d60f7f60e81e0a742b72e77 ↗
- https://github.com/advisories/GHSA-chj3-f7xw-367m ↗