CVE-2024-21532

CVSS 7.3 HIGHEPSS 1.2%CWE-78

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 7.3EPSS 1.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

08 out 2024Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

All versions of the package ggit are vulnerable to Command Injection via the fetchTags(branch) API, which allows user input to specify the branch to be fetched and then concatenates this string along with a git command which is then passed to the unsafe exec() Node.js child process API.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P

Produtos afetados

n/a · ggit

Referências

https://gist.github.com/lirantal/d8f87b366d2078e6118ab7bf2b005f02 https://github.com/bahmutov/ggit/blob/2e85b0316d9c272e067dca5679d39e302f4cb9cd/README.md?plain=1#L3 https://security.snyk.io/vuln/SNYK-JS-GGIT-5731320