Homepage

@simple-git/argv-parser@2.0.0

  • latest version

    2.0.1

  • latest non vulnerable version

    2.0.1

  • first published

    5 months ago

  • latest version published

    6 days ago

  • licenses detected

  • View argv-parser package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the @simple-git/argv-parser package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • C
    Command Injection

    Affected versions of this package are vulnerable to Command Injection via the prepareEnv function in parse-env.ts, which fails to recognize the VISUAL environment variable as a tracked unsafe editor key. Because VISUAL is not included in the GitEnvKeys map, it is silently discarded before collectConfigVulnerabilities inspects the environment, allowing an attacker-controlled VISUAL value to bypass the blockUnsafeOperationsPlugin spawn guard that would otherwise require the consumer to explicitly opt in to allowUnsafeEditor. This bypass permits an attacker who can influence the process environment to inject an arbitrary editor binary, potentially achieving remote code execution.

    How to fix Command Injection?

    Upgrade @simple-git/argv-parser to version 2.0.1 or higher.

    <2.0.1
    Go back to all versions of this package