CVE-2017-1000451: fs-git command injection vulnerability
Summary
CVE-2017-1000451: fs-git command injection vulnerability. Affects fs-git versions < 1.0.2. Fixed in 1.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
fs-git is an npm package that provides a file system-like API for Git repositories. It allows developers to interact with Git repositories programmatically. The version 1.0.1 of fs-git module relies on the child_process.exec function for executing commands. However, the buildCommand method used to construct exec strings does not properly sanitize user input, making it vulnerable to command injection attacks. This vulnerability affects all methods that use the buildCommand method and call exec.
Vulnerability Detail
The fs-git module's vulnerability arises from the lack of proper input sanitization in the buildCommand method. An attacker can exploit this vulnerability by injecting malicious commands into user-controlled input, leading to arbitrary command execution on the system. This can result in various security risks, including unauthorized access, data leakage, and remote code execution. The vulnerability has a CVSSv3 score of 7.8, indicating a high severity level.
How To Fix
Latest published version: 1.0.2 as of 22 Oct 2026
npm install fs-git@1.0.2The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the fs-git module is not immediately possible, developers can implement input validation and sanitization in their application code to mitigate the risk of command injection. It is crucial to carefully validate and sanitize any user-controlled input before passing it to the fs-git module's methods.
Conclusion
The fs-git module version 1.0.1 is vulnerable to command injection attacks due to improper input sanitization. Developers should update their fs-git module to version 1.0.2 or later to fix the vulnerability. If immediate update is not possible, implement input validation and sanitization in the application code. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for fs-git →
FAQ
fs-git is an npm package that provides a file system-like API for Git repositories. It allows developers to interact with Git repositories programmatically.
Command injection is a security vulnerability that occurs when untrusted user input is executed as a command by the application. In this case, the fs-git module is vulnerable to command injection, allowing an attacker to execute arbitrary commands on the system.
The potential risks of this vulnerability include unauthorized access, data leakage, and remote code execution. An attacker can exploit the vulnerability to execute arbitrary commands on the system, potentially compromising its security.
To fix the vulnerability, update the fs-git module to version 1.0.2 or later. This update includes proper input sanitization to prevent command injection attacks. Run the command 'npm install fs-git@latest' to update the module.
If updating the fs-git module is not immediately possible, implement input validation and sanitization in your application code. Carefully validate and sanitize any user-controlled input before passing it to the fs-git module's methods.
References
Related vulnerabilities
Recent vulnerabilities recorded for fs-git.
