CVE-2022-21235: Command Injection in github.com/Masterminds/vcs
Summary
CVE-2022-21235: Command injection in github.com/Masterminds/vcs. Affects github.com/Masterminds/vcs versions < 1.13.3. Fixed in 1.13.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/Masterminds/vcs package is a Go library that provides functionality for interacting with version control systems (VCS) such as Git, Mercurial, Bazaar, and Subversion. It allows users to perform various VCS operations like cloning repositories, fetching updates, and exporting directories. However, a vulnerability has been discovered in the package that allows for command injection attacks.
Vulnerability Detail
The vulnerability in github.com/Masterminds/vcs arises from the package's handling of user-provided arguments when executing VCS commands. These arguments can be interpreted as command-line flags, which can be manipulated by an attacker to inject arbitrary commands. This can lead to unauthorized execution of commands on the system where the vulnerable code is running. The impact of this vulnerability can range from unauthorized data access to complete compromise of the system.
How To Fix
Latest published version: v1.13.3 as of 22 Oct 2026
go get github.com/Masterminds/vcs@v1.13.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.13.3
This is the first release that contains the fix.
go get github.com/Masterminds/vcs@v1.13.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can manually sanitize and validate user-provided inputs before passing them to VCS functions. This involves checking for any potentially malicious characters or command sequences and rejecting or sanitizing them. Here's an example of how this can be done in Go:
import (
"os/exec"
"strings"
)
func sanitizeInput(input string) string {
// Remove any potentially malicious characters
sanitized := strings.ReplaceAll(input, "&", "")
// Sanitize any command sequences
sanitized = strings.ReplaceAll(sanitized, ";", "")
return sanitized
}
func main() {
userInput := getUserInput()
sanitizedInput := sanitizeInput(userInput)
// Pass the sanitized input to VCS functions
vcs.Get(sanitizedInput)
}
Conclusion
The github.com/Masterminds/vcs package is vulnerable to command injection, which can lead to unauthorized command execution and potential compromise of the system. Developers should update to version 1.13.3 or later to fix this vulnerability. Additionally, proper input validation and sanitization should be implemented to prevent command injection attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/Masterminds/vcs →
FAQ
The impact of this vulnerability can range from unauthorized data access to complete compromise of the system where the vulnerable code is running. Attackers can execute arbitrary commands, potentially leading to data leaks, unauthorized modifications, or even remote code execution.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it to identify any vulnerable dependencies.
At the time of this report, there are no known public exploits for this vulnerability. However, it is important to apply the recommended fix as soon as possible to mitigate the risk of potential attacks.
While it is strongly recommended to update to the fixed version of the github.com/Masterminds/vcs package, you can mitigate the vulnerability by manually sanitizing and validating user-provided inputs before passing them to VCS functions. Refer to the provided workaround section for an example of how this can be done.
This vulnerability was discovered by Alessio Della Libera of the Snyk Research Team.
