Executive brief
git-clone is a Node.js package used to programmatically clone Git repositories. The package allows developers to pass arbitrary arguments directly to the underlying git command through an "args" option, creating a command injection vulnerability when those arguments come from untrusted user input. An attacker could exploit this to execute arbitrary shell commands on systems using the vulnerable package.
Technical details
The vulnerability is a command injection flaw (CWE-77, CWE-88) in the git-clone npm package, where the "args" option insecurely passes user-controlled arguments directly to the git command without proper sanitization or escaping. All versions through 0.2.0 are affected. The attack vector is network-based if the application receiving user input is exposed online. An attacker can craft malicious input containing shell metacharacters to break out of the intended git command and execute arbitrary system commands. A fix was implemented via commit fd33045 that added a security notice, though comprehensive input validation should be implemented by developers using this package.
Affected products
- jaz303 git-clone 0.2.0 and earlier
Timeline
- 2022-07-02: disclosed: Advisory GHSA-8jmw-wjr8-2x66 published
- 2022-07-01: other: CVE-2022-25900 published on NVD
- 2022-07-06: patched: Security notice added via commit fd33045