CVE-2021-3190: OS Command Injection in async-git
Summary
CVE-2021-3190: OS Command Injection in async-git. Affects async-git versions < 1.13.2. Fixed in 1.13.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The async-git package is a Node.js library that provides asynchronous functions for interacting with Git repositories. It allows developers to perform various Git operations programmatically. However, versions before 1.13.2 of async-git are vulnerable to OS Command Injection, which can be exploited through shell metacharacters. This vulnerability can lead to remote code execution if the library is used with untrusted input. It is important to sanitize user input or update async-git to version 1.13.2 to mitigate this issue.
Vulnerability Detail
The OS Command Injection vulnerability in async-git arises due to the lack of proper input validation and sanitization. Attackers can exploit this vulnerability by injecting malicious commands through shell metacharacters. Specifically, the vulnerable methods git.reset and git.tag are susceptible to this issue. The impact of this vulnerability can be severe, as it can allow remote code execution on the affected system. It is crucial to address this vulnerability promptly to prevent potential exploitation.
How To Fix
Latest published version: 1.13.3 as of 23 Oct 2026
npm install async-git@1.13.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.13.2
This is the first release that contains the fix.
npm install async-git@1.13.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating async-git to version 1.13.2 is not immediately feasible, a temporary workaround is to sanitize user input before passing it to the vulnerable functions. This can be done by validating and filtering out any potentially malicious characters or commands. Here's an example of how input sanitization can be implemented in JavaScript:
const { exec } = require('child_process');
function sanitizeInput(input) {
return input.replace(/[&|;$`\<>]/g, '');
}
const userInput = sanitizeInput(userInputFromUser);
exec(`git reset ${userInput}`, (error, stdout, stderr) => {
// Handle the command execution and output
});
By sanitizing the user input, the risk of command injection can be significantly reduced.
Conclusion
The OS Command Injection vulnerability in async-git poses a significant risk to applications utilizing this package. It is crucial to update to version 1.13.2 or implement input sanitization to prevent potential exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for async-git →
FAQ
async-git is a Node.js library that provides asynchronous functions for interacting with Git repositories. It allows developers to perform various Git operations programmatically.
OS Command Injection is a vulnerability that occurs when an application allows user-supplied input to be executed as a command on the underlying operating system. Attackers can exploit this vulnerability to execute arbitrary commands, potentially leading to unauthorized access or remote code execution.
This vulnerability can be exploited by injecting malicious commands through shell metacharacters. In the case of async-git, the vulnerable methods git.reset and git.tag are susceptible to command injection if untrusted input is passed to them.
The potential consequences of this vulnerability include remote code execution, unauthorized access to sensitive information, and the ability to execute arbitrary commands on the affected system.
To mitigate this vulnerability, it is recommended to update async-git to version 1.13.2. Additionally, input validation and sanitization techniques should be implemented to prevent command injection attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for async-git.
