Command Injection

2022-06-1308:18:31

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.009 Low

EPSS

Percentile

82.4%

JSON

git-promise is vulnerable to command injection. The vulnerability exists in index.js due to an inappropriate fix for another vulnerability which allows an attacker to inject and execute arbitrary commands.

CPENameOperatorVersion
git-promisele1.0.0
git-promisele1.0.0

CPE	Name	Operator	Version
	git-promise	le	1.0.0
	git-promise	le	1.0.0

References

gist.github.com/lirantal/9da1fceb32f5279eb76a5fc1cb9707dd

github.com/piuccio/git-promise/commit/195aa982176b7bb3faa8695f91a1f6e0b620ec29

github.com/piuccio/git-promise/commit/ce122adb7b7ceae3813abeedadf73d57a67d39ba

github.com/piuccio/git-promise/pull/11

github.com/piuccio/git-promise/pull/8/files#diff-e727e4bdf3657fd1d798edcd6b099d6e092f8573cba266154583a746bba0f346L34-L49

0.009 Low

EPSS

Percentile

82.4%

JSON

Related for VERACODE:35961