CVE-2024-21532

CVSS 7.3 HIGHEPSS 1.2%CWE-78

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.3EPSS 1.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

08 Oct 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

All versions of the package ggit are vulnerable to Command Injection via the fetchTags(branch) API, which allows user input to specify the branch to be fetched and then concatenates this string along with a git command which is then passed to the unsafe exec() Node.js child process API.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P

Affected products

n/a · ggit

References

https://gist.github.com/lirantal/d8f87b366d2078e6118ab7bf2b005f02 https://github.com/bahmutov/ggit/blob/2e85b0316d9c272e067dca5679d39e302f4cb9cd/README.md?plain=1#L3 https://security.snyk.io/vuln/SNYK-JS-GGIT-5731320