Homepage

git-interface@0.0.6 vulnerabilities

some interfaces for work with git repository

  • latest version

    2.1.2

  • latest non vulnerable version

    2.1.2

  • first published

    10 years ago

  • latest version published

    2 years ago

  • licenses detected

  • View git-interface package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the git-interface package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • C
    Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

    git-interface is an interface to work with a git repository in node.js

    Affected versions of this package are vulnerable to Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'). The API may be abused if user input is able to provide a valid directory on disk and supply the destination directory to clone a repository too. If both are provided by user input, then the use of a --upload-pack command line argument feature of git is also supported for git clone, which would then allow for any operating system command to be spawned by the attacker.

    How to fix Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')?

    Upgrade git-interface to version 2.1.2 or higher.

    <2.1.2
    Go back to all versions of this package