CVE-2017-16087: Command Injection in fs-git
Summary
CVE-2017-16087: Command Injection in fs-git. Affects fs-git versions < 1.0.2. Fixed in 1.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fs-git package is an npm package that provides functionality for interacting with the file system using Git commands. It allows users to perform various operations such as reading, writing, and manipulating files and directories. However, versions of fs-git prior to 1.0.2 are vulnerable to command injection, which can lead to arbitrary code execution.
Vulnerability Detail
The vulnerability in fs-git arises from the lack of sanitization of strings passed into the buildCommand method. This allows an attacker to inject malicious commands into the system, potentially leading to arbitrary code execution. The impact of this vulnerability can be severe, as it grants unauthorized access and control over the affected system. The vulnerability is classified as CWE-77.
How To Fix
Latest published version: 1.0.2 as of 22 Oct 2026
npm install fs-git@1.0.2The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the patched version of the fs-git package to mitigate the risk.
Conclusion
The fs-git package prior to version 1.0.2 is vulnerable to command injection, allowing arbitrary code execution. To mitigate this risk, it is crucial to update to version 1.0.2 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for fs-git →
FAQ
The vulnerability allows an attacker to execute arbitrary code on the affected system, potentially leading to unauthorized access and control.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will alert you if the vulnerability is present.
No, only versions prior to 1.0.2 are affected. It is recommended to update to version 1.0.2 or later to fix the vulnerability.
No, there is no known workaround. Updating to the patched version is the only solution.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/05/GHSA-qr32-j4j6-3m7r/GHSA-qr32-j4j6-3m7r.json
References
Related vulnerabilities
Recent vulnerabilities recorded for fs-git.
