Skip to main content

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') in org.webjars.npm:simple-git

CVE-2022-24433

  • org.webjars.npm:simple-git
  • simple-git
High
9.8/10

Summary

The package simple-git versions prior to 3.3.0 are vulnerable to Command Injection via Argument Injection. When calling the ".fetch(remote, branch, handlerFn)" function, both the `remote` and `branch` parameters are passed to the `git fetch` subcommand. By injecting some `git options`, it was possible to get Arbitrary Command Execution.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

The software constructs a string for a command to executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

References

Advisory Timeline

  • Published