Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2025-59831
Summary
The package git-commiters is a Node.js function module providing committers stats for their git repository. In versions prior to 0.1.2, there is a Command Injection vulnerability in git-commiters. This vulnerability manifests with the library's primary exported API "gitCommiters(options, callback)" which allows specifying options such as "cwd" for current working directory and "revisionRange" as a revision pointer, such as "HEAD". However, the library does not sanitize for user input or practice secure process execution API to separate commands from their arguments and as such, uncontrolled user input is concatenated into command execution.
- LOW
- NETWORK
- HIGH
- UNCHANGED
- REQUIRED
- NONE
- HIGH
- HIGH
CWE-77 - Command Injection
A command injection attack involves injecting an operating system command through the data input, which gets executed on the host operating system with the privileges of the victimized application. The impact of a command injection attack may range from loss of data confidentiality and integrity to unauthorized remote access to the hosting system. The attack may cause serious data breaches and system takeover.
References
Advisory Timeline
- Published
