GHSA-9gqr-xp86-f87h

ghsaUSosv

Code injection in npm git

view advisory published 2022-03-18Licence: CC-BY-4.0

All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just git commands. At this time, there is no known workaround. There has been no patch released.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-23632US	critical9.8	2.35% (84th)	—	2022-03-17
All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just…

references

External citations — patches, advisories, analysis.

https://nvd.nist.gov/vuln/detail/CVE-2021-23632ADVISORY
https://snyk.io/vuln/SNYK-JS-GIT-1568518WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan