Arbitrary Code Execution

2022-10-1903:13:58

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

arbitrary code execution

powerline_gitstatus

git repositories

per-repository configurations

segments.py

malicious code injection

EPSS

0.001

Percentile

31.7%

JSON

powerline_gitstatus is vulnerable to arbitrary code execution. The vulnerability is due to the get_base_command function in segments.py with git repositories containing per-repository configurations that are being displayed when changing the directories which allows an attacker to inject and execute malicious codes in to the system.