GHSA-926x-m6m5-3mmpCriticalCVSS 9.8

push-dir Enables OS Command Injection

Published
February 9, 2022
Last Modified
September 11, 2023

🔗 CVE IDs covered (1)

CVE-2019-10803 →

📋 Description

push-dir through 0.4.1 allows execution of arbritary commands. Arguments provided as part of the variable opt.branch is not validated before being provided to the git command within index.js#L139. This could be abused by an attacker to inject arbitrary commands.

🎯 Affected products1

  • npm/push-dir:<= 0.4.1

🔗 References (4)