CVE-2020-26222: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

November 13, 2020 (updated December 3, 2020)

Dependabot is a set of packages for automated dependency management for Ruby, JavaScript, Python, PHP, Elixir, Rust, Java, .NET, Elm and Go. In Dependabot-Core from beta1, there is a remote code execution vulnerability in dependabot-common and dependabot-go_modules when a source branch name contains malicious injectable bash code.

References

github.com/dependabot/dependabot-core/commit/e089116abbe284425b976f7920e502b8e83a61b5
github.com/dependabot/dependabot-core/pull/2727
github.com/dependabot/dependabot-core/security/advisories/GHSA-23f7-99jx-m54r
nvd.nist.gov/vuln/detail/CVE-2020-26222

Code Behaviors & Features

Detect and mitigate CVE-2020-26222 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →