Arbitrary Command Injection in @npmcli/git
Summary
GHSA-hxwm-x553-x359: Arbitrary Command Injection due to Improper Command Sanitization. Affects @npmcli/git versions < 2.0.8. Fixed in 2.0.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @npmcli/git package is a component of the npm CLI tool used for executing Git commands. It allows users to interact with Git repositories and perform various operations. However, versions prior to 2.0.8 are vulnerable to arbitrary command injection due to improper argument sanitization. This vulnerability can be exploited when user-controlled input is passed as arguments to Git commands, potentially leading to the execution of arbitrary shell commands.
Vulnerability Detail
The vulnerability in @npmcli/git versions <2.0.8 arises from the lack of proper sanitization of user-controlled input when executing Git commands. By passing unsanitized input to a shell command, an attacker can inject arbitrary commands. For example, an attacker could include additional commands after a Git URL, such as 'git+https://github.com/npm/git; echo hello world', which would result in the execution of the 'echo hello world' command. This vulnerability has been addressed in version 2.0.8 by no longer running Git commands through an intermediate shell.
How To Fix
Minimum fixed version
2.0.8
This is the first release that contains the fix.
npm install @npmcli/git@2.0.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the patched version as soon as possible.
Conclusion
The vulnerability in @npmcli/git versions prior to 2.0.8 allows for arbitrary command injection, which can be exploited by passing unsanitized user input as arguments to Git commands. It is crucial to update to version 2.0.8 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for @npmcli/git →
FAQ
The impact of this vulnerability is arbitrary command injection, allowing an attacker to execute arbitrary shell commands.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your package-lock.json file and Vulert will alert you in real-time for any open-source vulnerabilities, including this one.
Yes, this vulnerability has been patched in version 2.0.8 of the @npmcli/git package.
This vulnerability was reported to the npm team by @tyage from Ierae Security through the GitHub Bug Bounty Program.
The CWE ID for this vulnerability is CWE-78.
