CVE-2019-10803

2020-02-2820:35:28

snyk

www.cve.org

AI Score

9.7

Confidence

High

EPSS

0.01

Percentile

83.3%

JSON

push-dir through 0.4.1 allows execution of arbritary commands. Arguments provided as part of the variable “opt.branch” is not validated before being provided to the “git” command within “index.js#L139”. This could be abused by an attacker to inject arbitrary commands.

CNA Affected

[
  {
    "product": "push-dir",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "All versions including 0.4.1"
      }
    ]
  }
]