Skip to content
CVE PROGRAM SOURCE RECORD7.3 High

CVE-2024-21532

All versions of the package ggit are vulnerable to Command Injection via the fetchTags(branch) API, which allows user input to specify the branch to be fetched and then concatenate

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
snyk

Description

All versions of the package ggit are vulnerable to Command Injection via the fetchTags(branch) API, which allows user input to specify the branch to be fetched and then concatenates this string along with a git command which is then passed to the unsafe exec() Node.js child process API.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a ggit

  • 0 to < *affected

References