Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@conventional-changelog/git-client

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3npmAmendedPublished

    @conventional-changelog/git-client has Argument Injection vulnerability

    CVE-2025-59433 · GHSA-vh25-5764-9wcr

    Affected
    • npm @conventional-changelog/git-client < 2.0.0
    Fixed in
    2.0.0· Vendor fix available
    Issue
    Background on exploitation This vulnerability manifests with the library's getTags() API, which allows specifying extra parameters passed to the git log command. In another API by this library - getRawCommits() there are secure practices taken to ensure that the extra parameter path is unable to inject an argument by ending the git log command with the special shell syntax --. However, the library does not follow the same practice for getTags() not attempts to sanitize for user input, validate the given params, or restrcit them to an allow list. Nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options. Thus, allowing users to exploit an argument injection vulnerability in Git due to the --output= command-line option that results with overwriting arbitrary files. Exploit 1. Install @conventional-changelog/git-client@1.0.1 or earlier 2. Prepare a Git directory to be used as source 3. Create the…

    Recommended action: Upgrade to 2.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →