Executive brief
mversion is a Node.js library used to manage version numbers in software projects. A command injection vulnerability in its git integration allows attackers to execute arbitrary shell commands if the library is called with untrusted input, particularly through git commit messages. This could lead to remote code execution and compromise of the build environment or development system.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the git.js module of mversion, where untrusted input is not properly sanitized before being passed to shell commands. Specifically, the commitMessage option in the update function can be exploited to inject arbitrary shell commands. The attack has a network vector and requires no authentication, though it depends on a caller (application or user) invoking the vulnerable function with attacker-controlled data. An attacker can achieve remote code execution with the privileges of the Node.js process. The vulnerability is fixed in version 2.0.0 and all earlier versions are deprecated.
Affected products
- mversion <2.0.0
Timeline
- 2020-06-17: disclosed
- 2020-06-18: patched: Version 2.0.0 released
- 2020-06-18: advisory