GHSA-hf8c-xr89-vfm5HighCVSS 8.8

Command Injection in ungit

Published
March 22, 2022
Last Modified
January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-25766 →

📋 Description

The package ungit before 1.5.20 are vulnerable to Remote Code Execution (RCE) via argument injection. The issue occurs when calling the /api/fetch endpoint. User controlled values (remote and ref) are passed to the git fetch command. By injecting some git options it was possible to get arbitrary command execution.

🎯 Affected products1

  • npm/ungit:< 1.5.20

🔗 References (6)