medium6.6
CVE-2021-23632
Code injection in npm git
Impact
All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just git commands. At this time, there is no known workaround. There has been no patch released.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | git | <= 0.1.5 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Git Project | Git | through 0.1.5 |