Executive brief
github-todos is a Node.js utility for managing GitHub issues. A command injection vulnerability in the _hook subcommand allows attackers to execute arbitrary system commands by injecting shell metacharacters into unsanitized input, potentially compromising systems that use this tool.
Technical details
The vulnerability is a command injection (CWE-78) in the _hook subcommand of github-todos version 3.1.0 and earlier. The range argument is concatenated directly into a shell command executed via the exec() function without validation or escaping. An attacker can inject arbitrary shell commands by crafting a malicious range parameter. The attack requires no authentication or special privileges, as the tool can be invoked by any user with command-line access. Successful exploitation results in arbitrary code execution with the privileges of the user running github-todos.
Affected products
- naholyr github-todos 3.1.0 and earlier
Timeline
- 2021-12-10: disclosed: Vulnerability published in GitHub Advisory Database
- 2021-08-05: other: Vulnerability initially reported and disclosed