Executive brief
The @npmcli/git library is used by npm developers to programmatically invoke Git commands. Versions before 2.0.8 passed unsanitized user input directly to shell commands, allowing attackers to inject arbitrary shell commands if an application uses this library with untrusted Git command arguments. This could lead to arbitrary code execution on systems running vulnerable versions.
Technical details
@npmcli/git prior to version 2.0.8 suffered from OS command injection (CWE-78) due to improper sanitization of user-controlled arguments passed to Git commands. The vulnerability arose because Git commands were executed through an intermediate shell without proper escaping or validation of input parameters. An attacker could craft malicious Git URLs or arguments (e.g., git+https://github.com/npm/git; echo hello world) to inject shell metacharacters and execute arbitrary commands. The attack requires the application to pass untrusted input to the Git command execution function. The issue was remediated in version 2.0.8 by eliminating shell invocation entirely, executing Git commands directly via process spawning without an intermediate shell.
Affected products
- npm @npmcli/git <2.0.8
Timeline
- 2021-07-27: disclosed
- 2021-08-05: patched: Fixed in version 2.0.8