Executive brief
git-parse is a JavaScript library used to parse and analyze Git repository data. The gitDiff function contains a command injection flaw that allows attackers to execute arbitrary system commands if the library is used to process untrusted Git input. Applications using this library without input validation could be compromised to run malicious code on the server.
Technical details
The vulnerability is a command injection flaw (CWE-74) in the gitDiff function of Wayfair's git-parse library versions <= 1.0.4. The function fails to properly sanitize or escape user-supplied input before passing it to shell command execution, allowing an attacker to inject arbitrary shell commands. The attack requires the application to call gitDiff with untrusted input (e.g., from a Git branch name, commit message, or diff output), but does not require authentication or special network conditions beyond reaching the vulnerable application. A successful exploit enables remote code execution with the privileges of the application process. The vulnerability was patched in version 1.0.5.
Affected products
- Wayfair git-parse <= 1.0.4
Timeline
- 2021-05-06: disclosed: CVE-2021-26543 published on NVD
- 2021: patched: Version 1.0.5 released with fix
- 2022-02-10: advisory: GHSA-m744-2jj8-vpfv published