Homepage
About Snyk

git-interface@2.1.1 vulnerabilities

some interfaces for work with git repository

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the git-interface package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • C
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

git-interface is an interface to work with a git repository in node.js

Affected versions of this package are vulnerable to Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'). The API may be abused if user input is able to provide a valid directory on disk and supply the destination directory to clone a repository too. If both are provided by user input, then the use of a --upload-pack command line argument feature of git is also supported for git clone, which would then allow for any operating system command to be spawned by the attacker.

How to fix Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')?

Upgrade git-interface to version 2.1.2 or higher.

<2.1.2
Go back to all versions of this package