GHSA-qffw-8wg7-h665

    Dashboard / Vulnerabilities / GHSA-qffw-8wg7-h665

    GHSA-qffw-8wg7-h665

    Published: 23 Apr 2022Last Modified: 8 Nov 2023
    Aliases:
    CVE-2022-1440

    Summary: Command injection in git-interface

    Details: A command injection vulnerability exists in git-interface in the GitHub repository yarkeev/git-interface prior to 2.1.2. If both the git remote and destination directory are provided by user input, then the use of an `--upload-pack` command-line argument feature of git is also supported for `git clone`, which would then allow for any operating system command to be spawned by the attacker.

    References: https://nvd.nist.gov/vuln/detail/CVE-2022-1440, https://github.com/yarkeev/git-interface/commit/f828aa790016fee3aa667f7b44cf94bf0aa8c60d, https://github.com/yarkeev/git-interface, https://huntr.dev/bounties/cdc25408-d3c1-4a9d-bb45-33b12a715ca1

    Affected packages

    Package

    Name: git-interface

    Purl: pkg:npm/git-interface

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -2.1.2

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-qffw-8wg7-h665 | CVE-DB