The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. Ensure to sanitize untrusted user input before passing it to one of the vulnerable functions as a workaround or update async-git to version 1.13.1.

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-3190
• omrilotan/async-git#13
• omrilotan/async-git@611823b
• omrilotan/async-git@a5f45f5
• omrilotan/async-git#14
• https://www.npmjs.com/package/async-git
• https://advisory.checkmarx.net/advisory/CX-2021-4772