fs-git command injection vulnerability
High severity
GitHub Reviewed
Published
May 13, 2022
to the GitHub Advisory Database
•
Updated Jul 31, 2023
Description
Published by the National Vulnerability Database
Jan 2, 2018
Published to the GitHub Advisory Database
May 13, 2022
Reviewed
Jul 31, 2023
Last updated
Jul 31, 2023
fs-git is a file system like api for git repository. The fs-git version 1.0.1 module relies on child_process.exec, however, the buildCommand method used to construct exec strings does not properly sanitize data and is vulnerable to command injection across all methods that use it and call exec.
References