CVE-2022-21235: Command Injection Vulnerability with Mercurial in VCS
Summary
CVE-2022-21235: Command Injection Vulnerability with Mercurial in VCS. Affects github.com/Masterminds/vcs versions < 1.13.2. Fixed in 1.13.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/Masterminds/vcs package is a Go library that provides an interface to interact with version control systems (VCS). It includes support for Mercurial (hg) as one of the underlying VCS. Mercurial is a distributed version control system that allows users to manage and track changes to their codebase. However, the vcs package is vulnerable to a command injection vulnerability when handling specially crafted URLs and local file paths passed to the Mercurial APIs. This vulnerability can be exploited if Mercurial is installed on the host operating system.
Vulnerability Detail
The vulnerability arises from the way the vcs package interacts with Mercurial. When executing Mercurial commands, the package allows additional flags to be set, which can be manipulated to perform a command injection. An attacker can craft malicious URLs or file paths that contain arbitrary commands, which will be executed by Mercurial when processed by the vcs package. This can lead to unauthorized command execution with the privileges of the user running the vulnerable code. The issue has been assigned a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: v1.13.3 as of 22 Oct 2026
go get github.com/Masterminds/vcs@v1.13.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.13.2
This is the first release that contains the fix.
go get github.com/Masterminds/vcs@v1.13.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A temporary workaround for this vulnerability is to sanitize any data passed to the vcs package APIs to ensure it does not contain commands or unexpected data. Developers should carefully validate and sanitize user input before passing it to the vulnerable APIs. This can involve techniques such as input validation, whitelisting, and proper escaping of user-supplied data. Implementing input validation and sanitization can help mitigate the risk of command injection until the package is updated to a secure version.
Conclusion
The github.com/Masterminds/vcs package is vulnerable to a critical command injection vulnerability when interacting with Mercurial. Developers should update their dependencies to version 1.13.2 or later to mitigate the risk. In the meantime, it is recommended to sanitize user input passed to the vulnerable APIs to prevent command injection. Regularly updating dependencies and following secure coding practices are essential for maintaining the security of software applications.
See every vulnerability recorded for github.com/Masterminds/vcs →
FAQ
The vulnerability allows an attacker to execute arbitrary commands on the host operating system with the privileges of the user running the vulnerable code. This can lead to unauthorized access, data leakage, or further compromise of the system.
No, versions prior to 1.13.2 are vulnerable. It is recommended to update to the latest secure version to mitigate the risk.
No, this vulnerability requires the attacker to have the ability to pass specially crafted URLs or file paths to the vulnerable APIs. It cannot be exploited remotely without some form of user interaction or access to the affected system.
There is no evidence of active exploitation of this vulnerability at the time of this advisory. However, it is crucial to apply the necessary updates and follow security best practices to mitigate the risk.
You can find more information about this vulnerability, including the fix and affected versions, in the official GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-6635-c626-vj4r/GHSA-6635-c626-vj4r.json
