Command Injection Vulnerability in Git Commit Info by JPeer264
CVE-2023-26134
9.8CRITICAL
What is CVE-2023-26134?
The git-commit-info package, prior to version 2.0.2, has a command injection vulnerability in its exported method gitCommitInfo(). This occurs due to inadequate sanitization of the 'commit' parameter, allowing attackers the potential to execute arbitrary commands through its integration with sensitive command execution APIs. By controlling the hash content, an attacker can leverage this flaw to run malicious commands, posing significant risks to the integrity and security of affected applications.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
git-commit-info 0 < 2.0.2
References
CVSS V3.1
Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Feng Xiao