Command Injection

Module: fs-git

Published: August 29th, 2017

Reported by: micaksica

CVE-NONE

CWE-

Vulnerable: <=1.0.1
Patched: >=1.0.2

Overview

fs-git is a file system like api for git repository.

The fs-git module relies on child_process.exec, however, the buildCommand method used to construct exec strings does not properly sanitize data and is vulnerable to command injection across all methods that use it and call exec.

Remediation

update to version 1.0.2 or later. In lieu of updating, before passing any untrusted data to the buildCommand function, ensure that the data is sanitized using a proper shell escaping library.

References

Sign up FREE for
nsp Continuous Security

Free for open source and the first private repo,
then just $1/mo per private repo