Command Injection Affecting async-git package, versions <1.13.1


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Proof of Concept
EPSS
5.9% (94th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Command Injection vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-JS-ASYNCGIT-1063505
  • published22 Jan 2021
  • disclosed22 Jan 2021
  • creditOmri Lotan

Introduced: 22 Jan 2021

CVE-2021-3190  (opens in a new tab)
CWE-78  (opens in a new tab)
First added by Snyk

How to fix?

Upgrade async-git to version 1.13.1 or higher.

Overview

async-git is a 👾 Retrieve data from current git repository

Affected versions of this package are vulnerable to Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag.

POC

git.reset('; touch HACKED #'); // file "HACKED" was created
git.tag('; touch HACKED #'); // file "HACKED" was created

References

CVSS Scores

version 3.1