漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Command Injection
Vulnerability Description
The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn(). However, the outpath parameter passed to it may be a command-line argument to the git clone command and result in arbitrary command injection.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability Type
N/A
Vulnerability Title
git-pull-or-clone 参数注入漏洞
Vulnerability Description
git-pull-or-clone是用于确保磁盘上存在 git 存储库并且它是最新的。 git-pull-or-clone 2.0.2之前版本存在参数注入漏洞，攻击者利用该漏洞可导致任意的命令注入。
CVSS Information
N/A
Vulnerability Type
N/A