Vulnerability · Published May 1, 2022 · Assigned by snyk
CVE-2022-24437Command Injection
Critical 9.8
In plain English
A critical-severity security flaw in git-pull-or-clone. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.7% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)3.7%top 10.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn(). However, the outpath parameter passed to it may be a command-line argument to the git clone command and result in arbitrary command injection.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | git-pull-or-clone | 2.0.2 | GHSA-3x62-x456-q2vm |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | git-pull-or-clone | unspecified – before 2.0.2 |