by Kastro
Paper/Archive/CVE-2022-24437

CVE-2022-24437

snyk — Command Injection

EPSS 4%CVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 89.8.898 × 2018.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn(). However, the outpath parameter passed to it may be a command-line argument to the git clone command and result in arbitrary command injection.

Affected

ProductAffectedFixed inSource
git-pull-or-cloneunspecified – < 2.0.22.0.2CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
snyk (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refsnyk.io/vuln/SNYK-JS-GITPULLORCLONE-2434307refgist.github.com/lirantal/327e9dd32686991b5a1fa6341aac2e7brefgithub.com/feross/git-pull-or-clone/commit/f9ce092be13cc32e685dfa26e7705e9c6e3108a3