GHSA-hxwm-x553-x359
Arbitrary Command Injection due to Improper Command Sanitization
GHSA-hxwm-x553-x359 is a vulnerability with no CVSS score yet in @npmcli/git, published August 5, 2021. No source lists public exploit code. Fixed in @npmcli/git 2.0.8.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.0.8@npmcli/git
Description
Summary
There exists a command injection vulnerability in npmcli/git versions <2.0.8 which may result in arbitrary shell command execution due to improper argument sanitization when npmcli/git is used to execute Git commands based on user controlled input.
The impact of this issue is possible Arbitrary Command Injection when npmcli/git is run with untrusted (user controlled) Git command arguments.
Impact
Arbitrary Command Injection
Details
npmcli/git prior to release 2.0.8 passed user controlled input as arguments to a shell command without properly sanitizing this input. Passing unsanitized input to a shell can lead to arbitrary command injection. For example passing git+https://github.com/npm/git; echo hello world would trigger the shell execution of echo hello world.
This issue was remediated by no longer running npmcli/git git commands through an intermediate shell.
Patches
This issue has been patched in release 2.0.8
Acknowledgements
This report was reported to us by @tyage (Ierae Security) through the GitHub Bug Bounty Program.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
@npmcli/gitnpm | before 2.0.8 | 2.0.8 |
What each source reports
GitHub AdvisoriesNo score
Arbitrary Command Injection due to Improper Command Sanitization
Summary
There exists a command injection vulnerability in npmcli/git versions <2.0.8 which may result in arbitrary shell command execution due to improper argument sanitization when npmcli/git is used to execute Git commands based on user controlled input.
The impact of this issue is possible Arbitrary Command Injection when npmcli/git is run with untrusted (user controlled) Git command arguments.
Impact
Arbitrary Command Injection
Details
npmcli/git prior to release 2.0.8 passed user controlled input as arguments to a shell command without properly sanitizing this input. Passing unsanitized input to a shell can lead to arbitrary command injection. For example passing git+https://github.com/npm/git; echo hello world would trigger the shell execution of echo hello world.
This issue was remediated by no longer running npmcli/git git commands through an intermediate shell.
Patches
This issue has been patched in release 2.0.8
Acknowledgements
This report was reported to us by @tyage (Ierae Security) through the GitHub Bug Bounty Program.
- Record
GHSA-hxwm-x553-x359- Weakness
- CWE-78
- Updated
- 2026-11-02
OSVNo score
Arbitrary Command Injection due to Improper Command Sanitization
Summary
There exists a command injection vulnerability in npmcli/git versions <2.0.8 which may result in arbitrary shell command execution due to improper argument sanitization when npmcli/git is used to execute Git commands based on user controlled input.
The impact of this issue is possible Arbitrary Command Injection when npmcli/git is run with untrusted (user controlled) Git command arguments.
Impact
Arbitrary Command Injection
Details
npmcli/git prior to release 2.0.8 passed user controlled input as arguments to a shell command without properly sanitizing this input. Passing unsanitized input to a shell can lead to arbitrary command injection. For example passing git+https://github.com/npm/git; echo hello world would trigger the shell execution of echo hello world.
This issue was remediated by no longer running npmcli/git git commands through an intermediate shell.
Patches
This issue has been patched in release 2.0.8
Acknowledgements
This report was reported to us by @tyage (Ierae Security) through the GitHub Bug Bounty Program.
- Record
GHSA-hxwm-x553-x359- Weakness
- CWE-78
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.