Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS13anFjLWo1Mzctajlnas0Z-A

Command injection in git-it-electron

Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step. During the verification process, it attempts to run the reflog command followed by the current branch name (which is not sanitized for execution).

Permalink: https://github.com/advisories/GHSA-wjqc-j537-j9gj
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS13anFjLWo1Mzctajlnas0Z-A
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 2 years ago
Updated: over 1 year ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-wjqc-j537-j9gj, CVE-2021-44685
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-44685
• https://github.com/dwisiswant0/advisory/issues/3
• https://github.com/jlord/git-it-electron/releases
• https://advisory.dw1.io/3
• https://github.com/advisories/GHSA-wjqc-j537-j9gj

Repository: https://github.com/dwisiswant0/advisory
Blast Radius: 0.0

Affected Packages