Executive brief
git-shallow-clone is a Node.js library used to quickly clone Git repositories by downloading only the latest revision. An argument injection vulnerability in the library allows attackers with local access to inject arbitrary command-line arguments, potentially leading to unauthorized data access or code execution.
Technical details
The vulnerability is an argument injection flaw (CWE-88) in the gitShallowClone function due to missing input sanitization or shell escaping flags when constructing the git command. The vulnerable code passes unsanitized user input directly to the process spawning mechanism without proper filtering. An attacker with local access and the ability to control input to the clone function can inject additional git command-line arguments to achieve unintended behavior. The vulnerability affects all versions through 0.0.2, and patches or updated versions may be available through the project repository.
Affected products
- npm git-shallow-clone 0.0.2 and earlier
Timeline
- 2024-10-01: disclosed
- 2024-10-01: advisory: GHSA-qwrq-vxvw-537r and CVE-2024-21531 published