CVE-2021-26543: Command injection in git-parse
Summary
CVE-2021-26543: Command injection in git-parse. Affects git-parse versions < 1.0.5. Fixed in 1.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The git-parse package is an npm package used for parsing and manipulating Git repositories. It provides various functions and utilities for interacting with Git repositories programmatically. The vulnerable version of git-parse is <=1.0.4. This package is commonly used by developers who work with Git repositories and may unknowingly introduce the vulnerability into their code.
Vulnerability Detail
The git-parse package, specifically the "gitDiff" function, is susceptible to a command injection vulnerability. This vulnerability allows an attacker to execute arbitrary commands on the host system by manipulating the input to the gitDiff function. As a result, an attacker can potentially gain unauthorized access, modify files, or execute malicious code on the system. This vulnerability has a CVSS score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
How To Fix
Minimum fixed version
1.0.5
This is the first release that contains the fix.
npm install git-parse@1.0.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of git-parse to mitigate the risk.
Conclusion
The git-parse package, specifically the "gitDiff" function, is vulnerable to command injection. This vulnerability can be mitigated by updating to version 1.0.5 or later of the git-parse package. It is crucial for developers to promptly update their projects to ensure the security of their Git repositories. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for git-parse →
FAQ
git-parse is an npm package used for parsing and manipulating Git repositories programmatically.
This vulnerability allows an attacker to execute arbitrary commands on the host system, potentially leading to unauthorized access, file modification, or execution of malicious code.
To fix this vulnerability, update the git-parse package to version 1.0.5 or later.
No, there is no known workaround. Updating to the fixed version is the recommended solution.
The CVSS score of this vulnerability is 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
