{"id":"GHSA-hxwm-x553-x359","aliases":[],"status":"published","title":"Arbitrary Command Injection due to Improper Command Sanitization","description":"### Summary\nThere exists a command injection vulnerability in `npmcli/git` versions \u003c2.0.8 which may result in arbitrary shell command execution due to improper argument sanitization when `npmcli/git` is used to execute Git commands based on user controlled input. \n\nThe impact of this issue is possible Arbitrary Command Injection when `npmcli/git` is run with untrusted (user controlled) Git command arguments. \n\n### Impact\n\nArbitrary Command Injection\n\n### Details\n\n`npmcli/git` prior to release `2.0.8` passed user controlled input as arguments to a shell command without properly sanitizing this input. Passing unsanitized input to a shell can lead to arbitrary command injection. For example passing `git+https://github.com/npm/git; echo hello world` would trigger the shell execution of `echo hello world`.  \n\nThis issue was remediated by no longer running `npmcli/git` git commands through an intermediate shell.\n\n### Patches\n\nThis issue has been patched in release `2.0.8`\n\n### Acknowledgements\n\nThis report was reported to us by @tyage (Ierae Security) through the [GitHub Bug Bounty Program](https://bounty.github.com).","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2021-08-05T17:07:39Z","modified":"2023-01-09T05:05:33Z","fixes":[{"ecosystem":"npm","package":"@npmcli/git","fixed_in":["2.0.8"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@npmcli/git","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8"}]}]},{"source":"osv","ecosystem":"npm","package":"@npmcli/git","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.8"}]}]}],"references":[{"url":"https://github.com/npm/git/security/advisories/GHSA-hxwm-x553-x359","tags":["web"]},{"url":"https://github.com/npm/git/pull/29","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hxwm-x553-x359"}],"sources":{"ghsa":[{"id":"GHSA-hxwm-x553-x359","title":"Arbitrary Command Injection due to Improper Command Sanitization","description":"### Summary\nThere exists a command injection vulnerability in `npmcli/git` versions \u003c2.0.8 which may result in arbitrary shell command execution due to improper argument sanitization when `npmcli/git` is used to execute Git commands based on user controlled input. \n\nThe impact of this issue is possible Arbitrary Command Injection when `npmcli/git` is run with untrusted (user controlled) Git command arguments. \n\n### Impact\n\nArbitrary Command Injection\n\n### Details\n\n`npmcli/git` prior to release `2.0.8` passed user controlled input as arguments to a shell command without properly sanitizing this input. Passing unsanitized input to a shell can lead to arbitrary command injection. For example passing `git+https://github.com/npm/git; echo hello world` would trigger the shell execution of `echo hello world`.  \n\nThis issue was remediated by no longer running `npmcli/git` git commands through an intermediate shell.\n\n### Patches\n\nThis issue has been patched in release `2.0.8`\n\n### Acknowledgements\n\nThis report was reported to us by @tyage (Ierae Security) through the [GitHub Bug Bounty Program](https://bounty.github.com).\n","status":"published","published":"2021-08-05T17:07:39Z","modified":"2023-01-09T05:05:33Z","cwes":["CWE-78"],"updated_at":"2026-11-02T14:36:11.367194Z"}],"osv":[{"id":"GHSA-hxwm-x553-x359","title":"Arbitrary Command Injection due to Improper Command Sanitization","description":"### Summary\nThere exists a command injection vulnerability in `npmcli/git` versions \u003c2.0.8 which may result in arbitrary shell command execution due to improper argument sanitization when `npmcli/git` is used to execute Git commands based on user controlled input. \n\nThe impact of this issue is possible Arbitrary Command Injection when `npmcli/git` is run with untrusted (user controlled) Git command arguments. \n\n### Impact\n\nArbitrary Command Injection\n\n### Details\n\n`npmcli/git` prior to release `2.0.8` passed user controlled input as arguments to a shell command without properly sanitizing this input. Passing unsanitized input to a shell can lead to arbitrary command injection. For example passing `git+https://github.com/npm/git; echo hello world` would trigger the shell execution of `echo hello world`.  \n\nThis issue was remediated by no longer running `npmcli/git` git commands through an intermediate shell.\n\n### Patches\n\nThis issue has been patched in release `2.0.8`\n\n### Acknowledgements\n\nThis report was reported to us by @tyage (Ierae Security) through the [GitHub Bug Bounty Program](https://bounty.github.com).\n","status":"published","published":"2021-08-05T17:07:39Z","modified":"2021-08-02T19:02:32Z","cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:49.621585Z"}]}}