Executive brief
giting is a Node.js package that provides git functionality. The package fails to properly validate user input before passing it to system commands, allowing attackers to inject arbitrary shell commands. An attacker with the ability to control the branch parameter can execute arbitrary code on the system running the application.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the giting npm package. The vulnerable code path exists in the pull function, which takes a branch parameter and passes it directly to an exec() call without sanitization or escaping. An attacker who can control the branch input (e.g., through application parameters or user-supplied data) can inject shell metacharacters to execute arbitrary commands with the privileges of the process running giting. No fix is currently available; users should consider switching to an alternative package.
Affected products
- npm giting all versions
Timeline
- 2020-09-04: disclosed: Published on GitHub Advisory Database