Command Injection vulnerability in git-interface@2.1.1 in yarkeev/git-interface

Command Injection vulnerability in git-interface@2.1.1 in GitHub repository yarkeev/git-interface prior to 2.1.2. If both are provided by user input, then the use of a `--upload-pack` command-line argument feature of git is also supported for `git clone`, which would then allow for any operating system command to be spawned by the attacker.

N/A

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

git-interface 操作系统命令注入漏洞

git-interface是俄罗斯Yarkeev Denis个人开发者的一个在 node.js 中使用 git 存储库的接口。 yarkeev git-interface 2.1.1之前版本存在安全漏洞，该漏洞源于应用中git clone和git --upload-pack命令行参数缺少过滤，导致命令注入功能。攻击者利用该漏洞可以进行操作系统命令注入。

N/A

N/A