CVE-2022-21235: Command Injection Vulnerability with Mercurial in VCS
Summary
CVE-2022-21235: Command injection in github.com/Masterminds/vcs. Affects github.com/Masterminds/vcs versions < 1.13.3. Fixed in 1.13.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/Masterminds/vcs package is a Go library that provides an interface to interact with version control systems. It includes support for Mercurial (hg) as one of the underlying version control systems. Mercurial is a distributed version control system that allows users to manage and track changes to their codebase. However, URLs and local file paths passed to the Mercurial APIs can be manipulated to contain commands that are executed by Mercurial if it is installed on the host operating system. This vulnerability allows an attacker to inject arbitrary commands and potentially execute malicious code on the system.
Vulnerability Detail
The vulnerability arises from the way the vcs package interacts with Mercurial. When executing hg commands, argument strings are passed in a way that allows additional flags to be set. An attacker can craft specially designed URLs or file paths that include these additional flags, leading to command injection. This can result in unauthorized code execution, data manipulation, or other malicious activities. The issue has been assigned a CVSS score of 9.8 (Critical severity).
How To Fix
Latest published version: v1.13.3 as of 22 Oct 2026
go get github.com/Masterminds/vcs@v1.13.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.13.3
This is the first release that contains the fix.
go get github.com/Masterminds/vcs@v1.13.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A workaround for this vulnerability is to sanitize any data passed to the vcs package APIs to ensure it does not contain commands or unexpected data. This can be done by validating and sanitizing user input before passing it to the package APIs. Additionally, it is recommended to implement input validation and restrict the use of user-supplied data in command execution.
Conclusion
The command injection vulnerability in the github.com/Masterminds/vcs package allows an attacker to execute arbitrary commands on the host system. It is crucial to update to version 1.13.2 or later of the package to fix this vulnerability. Additionally, developers should sanitize user input and implement input validation to prevent command injection attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/Masterminds/vcs →
FAQ
This vulnerability allows an attacker to execute arbitrary commands on the host system, potentially leading to unauthorized code execution, data manipulation, or other malicious activities.
Versions prior to 1.13.2 of the github.com/Masterminds/vcs package are affected by this vulnerability.
Other version control systems with an implemented interface may also be vulnerable to similar command injection attacks. It is recommended to review and sanitize data passed to the package APIs for any version control system.
At the time of this advisory, there are no known public exploits for this vulnerability. However, it is important to apply the recommended fix to mitigate the risk.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your Gopkg.lock file to the playground, and it will alert you if your application is vulnerable.
