What is GHSA-9gqr-xp86-f87h?

GHSA-9gqr-xp86-f87h is a security advisory published by GitHub Security Advisories with Medium severity. Code injection in npm git

Which CVE IDs does GHSA-9gqr-xp86-f87h cover?

GHSA-9gqr-xp86-f87h covers the following CVE IDs: CVE-2021-23632. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9gqr-xp86-f87h?

GHSA-9gqr-xp86-f87h has a CVSS v3 base score of 6.6, published by GitHub Security Advisories.

Which products are affected by GHSA-9gqr-xp86-f87h?

GHSA-9gqr-xp86-f87h affects 1 product, including: npm/git:\u003c= 0.1.5.

GHSA-9gqr-xp86-f87hMediumCVSS 6.6

Code injection in npm git

Vendor

GitHub Security Advisories

Published

March 18, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2021-23632 →

📋 Description

All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just git commands. At this time, there is no known workaround. There has been no patch released.

🎯 Affected products1

npm/git:<= 0.1.5

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2021-23632
https://snyk.io/vuln/SNYK-JS-GIT-1568518
https://github.com/advisories/GHSA-9gqr-xp86-f87h