Argument Injection

@conventional-changelog/git-client is vulnerable to Argument Injection. The vulnerability is due to improper handling of user-controlled parameters in the getTags API, due to the library failing to sanitize input, allowing attackers to inject arbitrary git arguments such as --output= and overwrit...

GHSA-VH25-5764-9WCR @conventional-changelog/git-client has Argument Injection vulnerability

Background on exploitation This vulnerability manifests with the library's getTags API, which allows specifying extra parameters passed to the git log command. In another API by this library - getRawCommits there are secure practices taken to ensure that the extra parameter path is unable to inje...