Executive brief
async-git is a Node.js library that provides programmatic access to git operations. Versions before 1.13.2 are vulnerable to command injection when shell metacharacters (like backticks) are passed as arguments to git methods, allowing an attacker to execute arbitrary system commands. This could lead to unauthorized code execution if user input is passed unsanitized to the library.
Technical details
The vulnerability is a command injection (CWE-78) caused by improper shell command construction. The library used shell-based invocation (likely via exec or similar) to run git commands instead of directly spawning the git process with argument arrays. An attacker can inject shell metacharacters (e.g., backticks for command substitution) into git method arguments to execute arbitrary commands on the system. No authentication or user interaction is required—the vulnerability is triggered by passing untrusted input to git methods. The fix, merged in PR #14, switches from shell-based invocation to process spawning, which safely separates arguments from command interpretation. Version 1.13.2 and later are patched.
Affected products
- async-git async-git before 1.13.2
Timeline
- 2021-02-18: disclosed: CVE-2020-28490 published on NVD
- 2021-01-24: patched: Fix merged in PR #14
- 2021-04-12: advisory: GHSA-6qpr-9mc5-7gch published