{"id":"GHSA-gm9x-q798-hmr4","aliases":[],"url":"https://o3.security/vulnerability/GHSA-gm9x-q798-hmr4","summary":"Command Injection in git-tags-remote","details":"All versions of `git-tags-remote ` are vulnerable to Command Injection. The package fails to sanitize the repository input and passes it directly to an `exec` call on the `get` function . This may allow attackers to execute arbitrary code in the system if the `repo` value passed to the function is user-controlled.  \n\nThe following proof-of-concept creates a file in `/tmp`:  \n```\nconst gitTagsRemote = require('git-tags-remote');\n\ngitTagsRemote.get('https://github.com/sh0ji/git-tags-remote.git; echo \"Injection Success\" > /tmp/command-injection.test')\n.then(tags => console.log(tags));\n```","published":"2020-07-29T14:53:40Z","modified":"2021-09-23T17:26:33Z","cvss":{"score":7.2,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"git-tags-remote","fixedVersion":"1.0.4"}],"fix":{"url":"https://github.com/sh0ji/git-tags-remote/commit/a20488960cbd2c98455386108253094897ebfc1c","label":"sh0ji/git-tags-remote@a204889"},"references":[{"type":"WEB","url":"https://github.com/sh0ji/git-tags-remote/issues/58"},{"type":"WEB","url":"https://github.com/sh0ji/git-tags-remote/commit/a20488960cbd2c98455386108253094897ebfc1c"},{"type":"PACKAGE","url":"https://github.com/sh0ji/git-tags-remote"},{"type":"WEB","url":"https://www.npmjs.com/advisories/1517"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2021-09-23T17:26:33Z"}}