Executive brief
The npm git package is a library that provides programmatic access to Git repository operations. A code injection vulnerability in the Git.git() method allows attackers to execute arbitrary operating system commands by injecting shell syntax into git command parameters. This could lead to complete system compromise including data theft, system modification, and service disruption for any application using this library.
Technical details
The vulnerability is a code injection flaw (CWE-78 OS Command Injection, CWE-94 Code Injection) in the Git.git() method due to missing input sanitization. Attackers can inject shell metacharacters (e.g., semicolons, pipes) into git command arguments to execute arbitrary OS commands beyond the intended git operations. The attack requires the attacker to control input passed to the git() method and have high privileges or high attack complexity according to some interpretations, though Snyk scores this 6.6 (medium, CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H). No patch has been released as of the advisory date; all versions through 0.1.5 are affected.
Affected products
- npm git 0 through 0.1.5
Timeline
- 2021-08-23: disclosed
- 2022-03-18: advisory: GHSA-9gqr-xp86-f87h published