Executive brief
git-archive is a Node.js module that converts bare Git repositories into archived tarballs. A command injection vulnerability in the exports function allows authenticated local attackers to execute arbitrary shell commands, potentially compromising the integrity and confidentiality of archived repositories and the host system.
Technical details
The git-archive npm package is vulnerable to command injection (CWE-78/CWE-77) within its exports function. The vulnerability arises from insufficient sanitization of user-controlled input that is passed to shell commands. An attacker with local access and basic user privileges can inject arbitrary shell commands through the exports function to achieve remote code execution. The vulnerability affects all versions up to and including 0.1.4, with no patched version currently available. Exploitation requires local access with low privileges but does not require user interaction.
Affected products
- npm git-archive 0 through 0.1.4
Timeline
- 2020-12-11: disclosed
- 2022-07-26: advisory