CVE-2021-3190

The CVE-2021-3190 issue affects the Node.js package async-git prior to 1.13.2, where OS Command Injection via shell metacharacters (demonstrated by git.reset and git.tag) is possible. The vulnerability may enable remote code execution in vulnerable environments. A remediation is to upgrade async-...

CVE-2020-28490

The CVE-2020-28490 entry concerns the npm package async-git prior to version 1.13.2, which is vulnerable to Command Injection via shell meta-characters (back-ticks). The issue is documented across multiple sources (GHSA, OSV, NVD, CVE listings, and Snyk) with the root cause being unsafe construct...