high7.2
CVE-2022-24376
OS Command Injection in git-promise
Impact
All versions of package git-promise is vulnerable to Command Injection due to an inappropriate fix of a prior [vulnerability](https://security.snyk.io/vuln/SNYK-JS-GITPROMISE-567476) in this package. **Note:** Please note that the vulnerability will not be fixed. The README file was updated with a warning regarding this issue. ### Credits @lirantal for discovering this vulnerability.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | git-promise | <= 1.0.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Git-Promise Project | Git-Promise | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://gist.github.com/lirantal/9da1fceb32f5279eb76a5fc1cb9707dd
- https://snyk.io/vuln/SNYK-JS-GITPROMISE-2434310
- https://github.com/advisories/GHSA-chj3-f7xw-367m
- https://nvd.nist.gov/vuln/detail/CVE-2022-24376
- https://github.com/lirantal/git-promise/commit/030e4f993f3b65419d60f7f60e81e0a742b72e77