Remote Code Execution (RCE) Affecting git package, versions >=1.2.0, <1.13.0
Threat Intelligence
EPSS
0.2% (59th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-GIT-3227617
- published 10 Jan 2023
- disclosed 9 Jan 2023
- credit Unknown
How to fix?
Upgrade git to version 1.13.0 or higher.
Overview
git is a Ruby library that can be used to create, read and manipulate Git repositories by wrapping system calls to the git binary.
Affected versions of this package are vulnerable to Remote Code Execution (RCE) due to the usage of the insecure eval() function in the ls_files() method, which results in unescaping of special characters from file paths.
References
CVSS Scores
version 3.1