Executive brief
meta-git is a Node.js package that manages multiple Git repositories. The package fails to sanitize branch names passed to the clone command, allowing attackers to inject arbitrary shell commands that execute with the privileges of the user running meta-git. This could enable complete system compromise or unauthorized code execution.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the meta-git clone command. The package passes user-supplied branch names directly to an exec call without sanitization or escaping, allowing attackers to inject shell metacharacters and arbitrary commands. An attacker needs to control the branch name parameter in a clone operation, which could occur if branch names are sourced from untrusted input or configuration files. A successful exploit grants the attacker the ability to execute arbitrary commands in the context of the process running meta-git. No patch is currently available; users should migrate to an alternative package.
Affected products
- npm meta-git all versions
Timeline
- 2020-09-04: disclosed