Homepage
About Snyk

libvcs@0.11.0 vulnerabilities

Lite, typed, python utilities for Git, SVN, Mercurial, etc.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the libvcs package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Command Injection

libvcs is a vcs abstraction layer.

Affected versions of this package are vulnerable to Command Injection via argument injection. When calling the update_repo function (when using hg), the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution.

How to fix Command Injection?

Upgrade libvcs to version 0.11.1 or higher.

[,0.11.1)
Go back to all versions of this package