Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@npmcli/git

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratednpmAmendedPublished

    Arbitrary Command Injection due to Improper Command Sanitization

    GHSA-hxwm-x553-x359

    Affected
    • npm @npmcli/git < 2.0.8
    Fixed in
    2.0.8· Vendor fix available
    Issue
    There exists a command injection vulnerability in npmcli/git versions <2.0.8 which may result in arbitrary shell command execution due to improper argument sanitization when npmcli/git is used to execute Git commands based on user controlled input. The impact of this issue is possible Arbitrary Command Injection when npmcli/git is run with untrusted (user controlled) Git command arguments. Impact Arbitrary Command Injection Details npmcli/git prior to release 2.0.8 passed user controlled input as arguments to a shell command without properly sanitizing this input. Passing unsanitized input to a shell can lead to arbitrary command injection. For example passing git+https://github.com/npm/git; echo hello world would trigger the shell execution of echo hello world. This issue was remediated by no longer running npmcli/git git commands through an intermediate shell. Patches This issue has been patched in release 2.0.8 Acknowledgements This report was reported to us by @tyage…

    Recommended action: Upgrade to 2.0.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →