Vulnerability · Published Feb 18, 2021 · Assigned by snyk

CVE-2020-28490Command Injection

Critical 9.1

In plain English

A critical-severity security flaw in async-git. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)2.5%top 14.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters (back-ticks). For example: git.reset('atouch HACKEDb')

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	async-git	1.13.2	GHSA-6qpr-9mc5-7gch

Affected products (as reported)

Vendor	Product	Versions
n/a	async-git	unspecified – before 1.13.2

References

https://snyk.io/vuln/SNYK-JS-ASYNCGIT-1064877 x_refsource_MISC
https://github.com/omrilotan/async-git/pull/14 x_refsource_MISC
https://github.com/omrilotan/async-git/commit/d1950a5021f4e19d92f347614be0d85ce991510d x_refsource_MISC