{"id":"CVE-2018-25083","aliases":["EUVD-2020-0906","GHSA-8px5-63x9-5c7p"],"status":"published","title":"pullit vulnerable to command injection","description":"The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02693,"percentile":0.85992,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77","CWE-78"],"published":"2020-09-03T16:47:30Z","modified":"2026-10-20T10:50:26Z","fixes":[{"ecosystem":"npm","package":"pullit","fixed_in":["1.4.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"pullit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0"}]}]},{"source":"osv","ecosystem":"npm","package":"pullit","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.0"}]}]}],"products":[{"vendor":"pull_it_project","product":"pull_it"}],"references":[{"url":"https://security.snyk.io/vuln/npm:pullit:20180214","tags":["x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://github.com/jkup/pullit/commit/4fec455774ee08f4dce0ef2ef934ffcc37219bfb","tags":["x_transferred","Patch","fix","web"]},{"url":"https://hackerone.com/reports/315773","tags":["web"]},{"url":"https://github.com/jkup/pullit/issues/23","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-25083","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-8px5-63x9-5c7p"},{"url":"https://github.com/jkup/pullit","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2018-25083","description":"The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name.","status":"published","published":"2023-03-27T00:00:00Z","modified":"2025-02-24T19:23:58.698Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:35:02.289647Z"}],"euvd":[{"id":"EUVD-2020-0906","description":"The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name.","status":"published","published":"2023-03-27T00:00:00Z","modified":"2025-02-24T19:23:58Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:53:25.075327Z"}],"ghsa":[{"id":"GHSA-8px5-63x9-5c7p","title":"pullit vulnerable to command injection","description":"Versions of `pullit` prior to 1.4.0 are vulnerable to Command Injection. The package does not validate input on git branch names  and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.\n\n## Recommendation\n\nUpgrade to version 1.4.0 or later.\n\n## Credits\n\nThis vulnerability was discovered by @lirantal","status":"published","published":"2020-09-03T16:47:30Z","modified":"2023-03-28T23:18:01Z","cwes":["CWE-77"],"updated_at":"2026-11-02T14:36:48.905887Z"}],"nvd":[{"id":"CVE-2018-25083","description":"The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name.","status":"published","published":"2023-03-27T03:15:07.103Z","modified":"2026-06-17T01:54:40.827Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:05:00.565712Z"}],"osv":[{"id":"CVE-2018-25083","description":"The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name.","status":"published","published":"2023-03-27T03:15:07.103Z","modified":"2026-10-20T10:50:26.086103735Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:09.442568Z"},{"id":"GHSA-8px5-63x9-5c7p","title":"pullit vulnerable to command injection","description":"Versions of `pullit` prior to 1.4.0 are vulnerable to Command Injection. The package does not validate input on git branch names  and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.\n\n## Recommendation\n\nUpgrade to version 1.4.0 or later.\n\n## Credits\n\nThis vulnerability was discovered by @lirantal","status":"published","published":"2020-09-03T16:47:30Z","modified":"2023-11-08T04:00:16.322767Z","cwes":["CWE-77"],"updated_at":"2026-11-02T15:46:42.78452Z"}]}}