Executive brief
The blamer Node.js library is used for analyzing file blame history from version control systems. Versions before 1.0.4 fail to properly validate file paths and command-line arguments passed to the underlying git binary, allowing attackers to inject arbitrary git command flags that could lead to information disclosure or repository manipulation.
Technical details
The vulnerability is an arbitrary argument injection (CWE-88) flaw in the blameByFile() API. The library does not sanitize user-supplied file paths or use proper argument delimitation (the POSIX double-dash --) when invoking the git binary, allowing attackers to inject malicious git command-line flags. An attacker with the ability to control the file path argument can inject options to alter git's behavior, potentially exposing sensitive information or modifying repository state. The vulnerability affects all versions prior to 1.0.4, which implements proper input validation and uses -- to delimit options from file arguments.
Affected products
- kucherenko blamer before 1.0.4
Timeline
- 2023-09-19: disclosed
- 2023-09-21: patched: fixed in version 1.0.4