{"id":"CVE-2020-26222","aliases":["EUVD-2020-1442","GHSA-23f7-99jx-m54r"],"status":"published","title":"Remote code execution in dependabot-core","description":"Dependabot is a set of packages for automated dependency management for Ruby, JavaScript, Python, PHP, Elixir, Rust, Java, .NET, Elm and Go. In Dependabot-Core from version 0.119.0.beta1 before version 0.125.1, there is a remote code execution vulnerability in dependabot-common and dependabot-go_modules when a source branch name contains malicious injectable bash code. For example, if Dependabot is configured to use the following source branch name: \"/$({curl,127.0.0.1})\", Dependabot will make a HTTP request to the following URL: 127.0.0.1 when cloning the source repository. The fix was applied to version 0.125.1. As a workaround, one can escape the branch name prior to passing it to the Dependabot::Source class.","severity":{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.03088,"percentile":0.87875,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74"],"published":"2020-11-13T15:47:50Z","modified":"2026-10-20T10:53:14Z","fixes":[{"ecosystem":"RubyGems","package":"dependabot-omnibus","fixed_in":["0.125.1"],"sources":["ghsa","osv"]},{"ecosystem":"RubyGems","package":"dependabot-common","fixed_in":["0.125.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"dependabot-omnibus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.119.0.beta1"},{"fixed":"0.125.1"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"dependabot-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.119.0.beta1"},{"fixed":"0.125.1"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"dependabot-omnibus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.119.0.beta1"},{"fixed":"0.125.1"}]}],"versions":["0.119.0","0.119.0.beta1","0.119.1","0.119.2","0.119.3","0.119.4","0.119.5","0.119.6","0.120.0","0.120.1","0.120.2","0.120.3","0.120.4","0.120.5","0.121.0","0.121.1","0.122.0","0.122.1","0.123.0","0.123.1","0.124.0","0.124.1","0.124.2","0.124.3","0.124.4","0.124.5","0.124.6","0.124.7","0.124.8","0.125.0"]},{"source":"osv","ecosystem":"RubyGems","package":"dependabot-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.119.0.beta1"},{"fixed":"0.125.1"}]}],"versions":["0.119.0","0.119.0.beta1","0.119.1","0.119.2","0.119.3","0.119.4","0.119.5","0.119.6","0.120.0","0.120.1","0.120.2","0.120.3","0.120.4","0.120.5","0.121.0","0.121.1","0.122.0","0.122.1","0.123.0","0.123.1","0.124.0","0.124.1","0.124.2","0.124.3","0.124.4","0.124.5","0.124.6","0.124.7","0.124.8","0.125.0"]}],"products":[{"vendor":"dependabot","product":"dependabot-core"},{"vendor":"dependabot_project","product":"dependabot"}],"references":[{"url":"https://github.com/dependabot/dependabot-core/security/advisories/GHSA-23f7-99jx-m54r","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://github.com/dependabot/dependabot-core/pull/2727","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/dependabot/dependabot-core/commit/e089116abbe284425b976f7920e502b8e83a61b5","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://rubygems.org/gems/dependabot-common","tags":["web"]},{"url":"https://rubygems.org/gems/dependabot-omnibus","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-26222","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/dependabot-omnibus/CVE-2020-26222.yml","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/dependabot-common/CVE-2020-26222.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-23f7-99jx-m54r"},{"url":"https://github.com/dependabot/dependabot-core","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-26222","title":"Remote code execution in dependabot-core","description":"Dependabot is a set of packages for automated dependency management for Ruby, JavaScript, Python, PHP, Elixir, Rust, Java, .NET, Elm and Go. In Dependabot-Core from version 0.119.0.beta1 before version 0.125.1, there is a remote code execution vulnerability in dependabot-common and dependabot-go_modules when a source branch name contains malicious injectable bash code. For example, if Dependabot is configured to use the following source branch name: \"/$({curl,127.0.0.1})\", Dependabot will make a HTTP request to the following URL: 127.0.0.1 when cloning the source repository. The fix was applied to version 0.125.1. As a workaround, one can escape the branch name prior to passing it to the Dependabot::Source class.","status":"published","published":"2020-11-13T16:00:20Z","modified":"2024-08-04T15:49:07.167Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:35:45.763329Z"}],"euvd":[{"id":"EUVD-2020-1442","description":"Dependabot is a set of packages for automated dependency management for Ruby, JavaScript, Python, PHP, Elixir, Rust, Java, .NET, Elm and Go. In Dependabot-Core from version 0.119.0.beta1 before version 0.125.1, there is a remote code execution vulnerability in dependabot-common and dependabot-go_modules when a source branch name contains malicious injectable bash code. For example, if Dependabot is configured to use the following source branch name: \"/$({curl,127.0.0.1})\", Dependabot will make a HTTP request to the following URL: 127.0.0.1 when cloning the source repository. The fix was applied to version 0.125.1. As a workaround, one can escape the branch name prior to passing it to the Dependabot::Source class.","status":"published","published":"2020-11-13T16:00:20Z","modified":"2024-08-04T15:49:07Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T03:07:16.308974Z"}],"ghsa":[{"id":"GHSA-23f7-99jx-m54r","title":"Remote code execution in dependabot-core branch names when cloning","description":"### Impact\nRemote code execution vulnerability in `dependabot-common` and  `dependabot-go_modules` when a source branch name contains malicious injectable bash code.\n\nFor example, if Dependabot is configured to use the following source branch name: `\"/$({curl,127.0.0.1})\"`, Dependabot will make a HTTP request to the following URL: 127.0.0.1 when cloning the source repository.\n\nWhen Dependabot is configured to clone the source repository during an update, Dependabot runs a shell command to git clone the repository:\n\n```bash\ngit clone --no-tags --no-recurse-submodules --depth=1 --branch=\u003cBRANCH\u003e --single-branch \u003cGITHUB_REPO_URL\u003e repo/contents/path\n```\n\nDependabot will always clone the source repository for `go_modules` during the file fetching step and can be configured to clone the repository for other package managers using the `FileFetcher` class from `dependabot-common`.\n\n```ruby\nsource = Dependabot::Source.new(\n  provider: \"github\",\n  repo: \"repo/name\",\n  directory: \"/\",\n  branch: \"/$({curl,127.0.0.1})\",\n)\n\nrepo_contents_path = \"./file/path\"\nfetcher = Dependabot::FileFetchers.for_package_manager(\"bundler\").\n                  new(source: source, credentials: [],\n                  repo_contents_path: repo_contents_path)\nfetcher.clone_repo_contents\n```\n\n### Patches\n\nThe fix was applied to version `0.125.1`: https://github.com/dependabot/dependabot-core/pull/2727\n\n### Workarounds\nEscape the branch name prior to passing it to the `Dependabot::Source` class.\n\nFor example using `shellwords`:\n\n```ruby\nrequire \"shellwords\"\nbranch = Shellwords.escape(\"/$({curl,127.0.0.1})\")\nsource = Dependabot::Source.new(\n  provider: \"github\",\n  repo: \"repo/name\",\n  directory: \"/\",\n  branch: branch,\n)\n```","status":"published","published":"2020-11-13T15:47:50Z","modified":"2023-11-06T05:01:00Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:37:14.234712Z"}],"nvd":[{"id":"CVE-2020-26222","description":"Dependabot is a set of packages for automated dependency management for Ruby, JavaScript, Python, PHP, Elixir, Rust, Java, .NET, Elm and Go. In Dependabot-Core from version 0.119.0.beta1 before version 0.125.1, there is a remote code execution vulnerability in dependabot-common and dependabot-go_modules when a source branch name contains malicious injectable bash code. For example, if Dependabot is configured to use the following source branch name: \"/$({curl,127.0.0.1})\", Dependabot will make a HTTP request to the following URL: 127.0.0.1 when cloning the source repository. The fix was applied to version 0.125.1. As a workaround, one can escape the branch name prior to passing it to the Dependabot::Source class.","status":"published","published":"2020-11-13T16:15:18.277Z","modified":"2026-06-17T03:07:51.293Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:06:24.137599Z"}],"osv":[{"id":"CVE-2020-26222","description":"Dependabot is a set of packages for automated dependency management for Ruby, JavaScript, Python, PHP, Elixir, Rust, Java, .NET, Elm and Go. In Dependabot-Core from version 0.119.0.beta1 before version 0.125.1, there is a remote code execution vulnerability in dependabot-common and dependabot-go_modules when a source branch name contains malicious injectable bash code. For example, if Dependabot is configured to use the following source branch name: \"/$({curl,127.0.0.1})\", Dependabot will make a HTTP request to the following URL: 127.0.0.1 when cloning the source repository. The fix was applied to version 0.125.1. As a workaround, one can escape the branch name prior to passing it to the Dependabot::Source class.","status":"published","published":"2020-11-13T16:15:18.277Z","modified":"2026-10-20T10:53:14.746552268Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:15.879068Z"},{"id":"GHSA-23f7-99jx-m54r","title":"Remote code execution in dependabot-core branch names when cloning","description":"### Impact\nRemote code execution vulnerability in `dependabot-common` and  `dependabot-go_modules` when a source branch name contains malicious injectable bash code.\n\nFor example, if Dependabot is configured to use the following source branch name: `\"/$({curl,127.0.0.1})\"`, Dependabot will make a HTTP request to the following URL: 127.0.0.1 when cloning the source repository.\n\nWhen Dependabot is configured to clone the source repository during an update, Dependabot runs a shell command to git clone the repository:\n\n```bash\ngit clone --no-tags --no-recurse-submodules --depth=1 --branch=\u003cBRANCH\u003e --single-branch \u003cGITHUB_REPO_URL\u003e repo/contents/path\n```\n\nDependabot will always clone the source repository for `go_modules` during the file fetching step and can be configured to clone the repository for other package managers using the `FileFetcher` class from `dependabot-common`.\n\n```ruby\nsource = Dependabot::Source.new(\n  provider: \"github\",\n  repo: \"repo/name\",\n  directory: \"/\",\n  branch: \"/$({curl,127.0.0.1})\",\n)\n\nrepo_contents_path = \"./file/path\"\nfetcher = Dependabot::FileFetchers.for_package_manager(\"bundler\").\n                  new(source: source, credentials: [],\n                  repo_contents_path: repo_contents_path)\nfetcher.clone_repo_contents\n```\n\n### Patches\n\nThe fix was applied to version `0.125.1`: https://github.com/dependabot/dependabot-core/pull/2727\n\n### Workarounds\nEscape the branch name prior to passing it to the `Dependabot::Source` class.\n\nFor example using `shellwords`:\n\n```ruby\nrequire \"shellwords\"\nbranch = Shellwords.escape(\"/$({curl,127.0.0.1})\")\nsource = Dependabot::Source.new(\n  provider: \"github\",\n  repo: \"repo/name\",\n  directory: \"/\",\n  branch: branch,\n)\n```","status":"published","published":"2020-11-13T15:47:50Z","modified":"2026-07-08T06:29:09.252313036Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:46:33.520522Z"}]}}