Executive brief
git-dummy-commit is a Node.js utility used to create dummy Git commits. A command injection vulnerability in version 1.3.0 allows an attacker to execute arbitrary operating system commands through an unescaped parameter, potentially compromising any system using this package to automate Git operations.
Technical details
The vulnerability is a command injection flaw (CWE-78) in git-dummy-commit v1.3.0 caused by insufficient input validation—a parameter is passed to an OS command without proper escaping or sanitization. An attacker can inject shell metacharacters to execute arbitrary commands with the privileges of the process running git-dummy-commit. The attack vector is network-adjacent or local depending on how the package is invoked; no authentication is required. A successful exploit results in arbitrary code execution on the affected system. The vulnerability affects all versions up to and including 1.3.0; patch status is not explicitly stated in the advisory.
Affected products
- npm git-dummy-commit up to and including 1.3.0
Timeline
- 2018-08-21: disclosed
- 2018-08-17: advisory: NVD published