Executive brief
npm-git-publish is a Node.js utility for publishing packages to npm and git repositories. The package contains a command injection vulnerability in how it processes the git remote URL, allowing attackers to execute arbitrary system commands if they can control the input to the publish function. Until a patch is released, users should switch to an alternative package to avoid this risk.
Technical details
The vulnerability is a command injection issue (CWE-77) in the publish function of npm-git-publish. The gitRemoteUrl parameter is passed directly to an execSync call without proper input sanitization or escaping, allowing an attacker to inject shell metacharacters and arbitrary commands. This vulnerability affects all versions of the package. An attacker who can control the gitRemoteUrl input (e.g., through a compromised dependency or malicious pull request) can execute arbitrary code in the context of the npm-git-publish process. No patch has been made available; users are advised to discontinue use of this package until a fix is released.
Affected products
- npm npm-git-publish all versions
Timeline
- 2020-09-04: disclosed: Vulnerability published on GitHub Advisory Database
- 2020-08-31: other: GitHub security team review completed