Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
@conventional-changelog/git-client has an Argument Injection vulnerability
Vulnerability Description
Conventional Changelog generates changelogs and release notes from a project's commit messages and metadata. Prior to version 2.0.0, @conventional-changelog/git-client has an argument injection vulnerability. This vulnerability manifests with the library's getTags() API, which allows extra parameters to be passed to the git log command. In another API by this library, getRawCommits(), there are secure practices taken to ensure that the extra parameter path is unable to inject an argument by ending the git log command with the special shell syntax --. However, the library does not follow the same practice for getTags() as it does not attempt to sanitize for user input, validate the given params, or restrict them to an allow list. Nor does it properly pass command-line flags to the git binary using the double-dash POSIX characters (--) to communicate the end of options. Thus, allowing users to exploit an argument injection vulnerability in Git due to the --output= command-line option that results with overwriting arbitrary files. This issue has been patched in version 2.0.0.
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:H
Vulnerability Type
参数注入或修改
Vulnerability Title
Conventional Changelog 参数注入漏洞
Vulnerability Description
Conventional Changelog是Conventional Changelog开源的一个更新日志生成工具。 Conventional Changelog 2.0.0之前版本存在参数注入漏洞，该漏洞源于未对getTags API中的用户输入进行清理或验证，可能导致参数注入攻击，从而覆盖任意文件。
CVSS Information
N/A
Vulnerability Type
N/A