Executive brief
git-promise is a Node.js library that wraps Git command execution. Due to improper input validation, attackers can inject arbitrary OS commands through the library's API, potentially gaining full command execution on systems using git-promise. The library maintainers have not issued a patch and instead only added a security warning to the README.
Technical details
git-promise contains an OS command injection vulnerability (CWE-77, CWE-88) in its command execution logic. The vulnerability stems from inadequate sanitization of user inputs passed to Git commands, allowing attackers to inject arbitrary shell commands. The flaw affects all versions of the library (0 through 1.0.0). An attacker with high privilege access or who can influence function parameters can execute arbitrary OS commands with the privileges of the process running the library. No security patch has been released; the maintainers have only documented the vulnerability in the README file.
Affected products
- git-promise git-promise 0 through 1.0.0
Timeline
- 2022-06-10: disclosed
- 2022-06-11: advisory