Versions of pullit prior to 1.4.0 are vulnerable to Command Injection. The package does not validate input on git branch names and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.
Upgrade to version 1.4.0 or later.
This vulnerability was discovered by @lirantal
| Score | Percentile |
|---|---|
| 17.56% | 95.08% |
No CVSS scores in this advisory.
| Type | Value |
|---|---|
| GHSA | GHSA-8px5-63x9-5c7p ↗ |
| CVE | CVE-2018-25083 ↗ |
| CWE id | Name |
|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') |
Vulnerable version ranges and first patched releases as published by GitHub.
| Ecosystem | Package | Vulnerable range | First patched | Vulnerable functions |
|---|---|---|---|---|
| npm | pullit | < 1.4.0 | 1.4.0 | — |