CVE-2022-24437: OS Command Injection in git-pull-or-clone
Summary
CVE-2022-24437: OS Command Injection in git-pull-or-clone. Affects git-pull-or-clone versions < 2.0.2. Fixed in 2.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The git-pull-or-clone package is an npm package that provides functionality for pulling or cloning Git repositories. It utilizes the --upload-pack feature of git, which is also supported for git clone operations. The package uses the secure child process API spawn() for executing commands. However, a vulnerability exists in versions prior to 2.0.2, where the outpath parameter passed to spawn() can be manipulated to inject arbitrary commands into the git clone command.
Vulnerability Detail
The vulnerability in git-pull-or-clone allows for OS command injection. By manipulating the outpath parameter, an attacker can inject arbitrary commands into the git clone command. This can lead to various security risks, including remote code execution, unauthorized access to sensitive information, and potential compromise of the host system. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 2.0.2 as of 23 Oct 2026
npm install git-pull-or-clone@2.0.2The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the package to the fixed version to mitigate the risk of OS command injection.
Conclusion
The OS command injection vulnerability in git-pull-or-clone can have severe consequences, including remote code execution and unauthorized access. It is crucial to update the package to version 2.0.2 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for git-pull-or-clone →
FAQ
The vulnerability allows for OS command injection, which can lead to remote code execution, unauthorized access to sensitive information, and potential compromise of the host system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using package-lock.json.
Yes, updating the git-pull-or-clone package to version 2.0.2 or later fixes this vulnerability. It is recommended to update the package as soon as possible.
No, there are no known workarounds for this vulnerability. Updating the package to the fixed version is the recommended solution.
This vulnerability was discovered by @lirantal and reported to the package maintainers.
